DIP Engine 2 Updated

Posts 1–15 of 24 · Page 1 of 2

The function of DIP Engine has changed then some loggers can't find the address of it.
This hook is already DETECTED by X-TRAP

Code:

004C3432 |. 8B9C24 3C02000>|MOV EBX,DWORD PTR SS:[ESP+23C] 004C3439 |> 8B55 08 |MOV EDX,DWORD PTR SS:[EBP+8] 004C343C |. 2B5424 10 |SUB EDX,DWORD PTR SS:[ESP+10] 004C3440 |. 0FB74D 00 |MOVZX ECX,WORD PTR SS:[EBP] 004C3444 |. 8B35 E8527200 |MOV ESI,DWORD PTR DS:[7252E8] => Device Game 004C344A |. B8 ABAAAAAA |MOV EAX,AAAAAAAB 004C344F |. F7E2 |MUL EDX 004C3451 |. 0FB745 02 |MOVZX EAX,WORD PTR SS:[EBP+2] 004C3455 |. 8BFA |MOV EDI,EDX 004C3457 |. D1EF |SHR EDI,1 004C3459 |. 894424 24 |MOV DWORD PTR SS:[ESP+24],EAX 004C345D |. 894C24 20 |MOV DWORD PTR SS:[ESP+20],ECX 004C3461 |. E8 DAA00000 |CALL crossfir.004CD540 004C3466 |. 57 |PUSH EDI 004C3467 |. 8BD6 |MOV EDX,ESI 004C3469 |. 8B02 |MOV EAX,DWORD PTR DS:[EDX] 004C346B |. 8B5424 14 |MOV EDX,DWORD PTR SS:[ESP+14] 004C346F |. 8B08 |MOV ECX,DWORD PTR DS:[EAX] 004C3471 |. 52 |PUSH EDX 004C3472 |. 8B5424 2C |MOV EDX,DWORD PTR SS:[ESP+2C] 004C3476 |. 52 |PUSH EDX 004C3477 |. 8B5424 2C |MOV EDX,DWORD PTR SS:[ESP+2C] 004C347B |. 52 |PUSH EDX 004C347C |. 6A 00 |PUSH 0 004C347E |. 6A 04 |PUSH 4 004C3480 |. 50 |PUSH EAX 004C3481 |. 8B81 48010000 |MOV EAX,DWORD PTR DS:[ECX+148] 004C3487 |. FFD0 |CALL EAX => Return

Code:

DWORD DIPEngine = 0x4C3480; // Search the address inside of crossfire.exe, this address is for Crossfire[AL] DWORD retDIPEngine = ( DIPEngine + 0x7 ); __declspec( naked ) HRESULT WINAPI DIPEngineMidfunction( VOID ) { static LPDIRECT3DDEVICE9 pDevice; __asm { PUSH EAX MOV DWORD PTR DS:[pDevice], EAX MOV EAX, DWORD PTR DS:[ECX + 0x148] PUSHAD } pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE ); // Others stuffs here ... __asm { POPAD JMP DWORD PTR DS:[retDIPEngine] } }

Screen Shoot Proof:

Crédits:
@Shad0w_ => Midfunction mehtod
@WE11ington => Posted this method +/- 9-10 months ago

Nice work.

How do this hook undetected?

@luizimloko Yes, you're right.. the currently logger I'm using in the DIP Engine 2 becomes 0x00000000. Thanks for this update bro.

by the way.. do you have the DIP Engine 2 pattern for CFPH? Thanks..

Originally Posted by remzkee0903

@luizimloko Yes, you're right.. the currently logger I'm using in the DIP Engine 2 becomes 0x00000000. Thanks for this update bro.

by the way.. do you have the DIP Engine 2 pattern for CFPH? Thanks..

I think it is the same ...

Good Job , But i need Endscence or present hook ..

I think crossfire is scanning now every hooked thing in crossfire.exe or cshell thats why the dip engine is detected by xtrap^^

nice work

Originally Posted by luizimloko

The function of DIP Engine has changed then some loggers can't find the address of it.
This hook is already DETECTED by X-TRAP

Code:

004C3432 |. 8B9C24 3C02000>|MOV EBX,DWORD PTR SS:[ESP+23C] 004C3439 |> 8B55 08 |MOV EDX,DWORD PTR SS:[EBP+8] 004C343C |. 2B5424 10 |SUB EDX,DWORD PTR SS:[ESP+10] 004C3440 |. 0FB74D 00 |MOVZX ECX,WORD PTR SS:[EBP] 004C3444 |. 8B35 E8527200 |MOV ESI,DWORD PTR DS:[7252E8] => Device Game 004C344A |. B8 ABAAAAAA |MOV EAX,AAAAAAAB 004C344F |. F7E2 |MUL EDX 004C3451 |. 0FB745 02 |MOVZX EAX,WORD PTR SS:[EBP+2] 004C3455 |. 8BFA |MOV EDI,EDX 004C3457 |. D1EF |SHR EDI,1 004C3459 |. 894424 24 |MOV DWORD PTR SS:[ESP+24],EAX 004C345D |. 894C24 20 |MOV DWORD PTR SS:[ESP+20],ECX 004C3461 |. E8 DAA00000 |CALL crossfir.004CD540 004C3466 |. 57 |PUSH EDI 004C3467 |. 8BD6 |MOV EDX,ESI 004C3469 |. 8B02 |MOV EAX,DWORD PTR DS:[EDX] 004C346B |. 8B5424 14 |MOV EDX,DWORD PTR SS:[ESP+14] 004C346F |. 8B08 |MOV ECX,DWORD PTR DS:[EAX] 004C3471 |. 52 |PUSH EDX 004C3472 |. 8B5424 2C |MOV EDX,DWORD PTR SS:[ESP+2C] 004C3476 |. 52 |PUSH EDX 004C3477 |. 8B5424 2C |MOV EDX,DWORD PTR SS:[ESP+2C] 004C347B |. 52 |PUSH EDX 004C347C |. 6A 00 |PUSH 0 004C347E |. 6A 04 |PUSH 4 004C3480 |. 50 |PUSH EAX 004C3481 |. 8B81 48010000 |MOV EAX,DWORD PTR DS:[ECX+148] 004C3487 |. FFD0 |CALL EAX => Return

Code:

DWORD DIPEngine = 0x4C3480; // Search the address inside of crossfire.exe, this address is for Crossfire[AL] DWORD retDIPEngine = ( DIPEngine + 0x7 ); __declspec( naked ) HRESULT WINAPI DIPEngineMidfunction( VOID ) { static LPDIRECT3DDEVICE9 pDevice; __asm { PUSH EAX MOV DWORD PTR DS:[pDevice], EAX MOV EAX, DWORD PTR DS:[ECX + 0x148] PUSHAD } pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE ); // Others stuffs here ... __asm { POPAD JMP DWORD PTR DS:[retDIPEngine] } }

Crédits:
@Shad0w_ => Midfunction mehtod
@WE11ington => Posted this method +/- 1 year ago (for CA 1 year and 5 months, idk....)

Taked Combat Arms DIP Engine from refference ?

Originally Posted by XarutoUsoCrack

Taked Combat Arms DIP Engine from refference ?

no, i find it alone ...

Originally Posted by luizimloko

no, i find it alone ...

I have been in combat arm section for ever. This is definitely from there, just updated it for crossfire lol.

Originally Posted by Skaterforeva1

I have been in combat arm section for ever. This is definitely from there, just updated it for crossfire lol.

you think that same pattern scan for CA works on CF ?

Originally Posted by luizimloko

you think that same pattern scan for CA works on CF ?

You can search for the exactly same hook by asm commands lines
And i think hooking in crossfire is detected ..
Anyway thanks

Are you there endScene / present hook?

DWORD WINAPI StartRoutine( LPVOID )
{
while( TRUE )
{
if( memcmp( ( VOID * )DIPEngine, ( VOID * )( PBYTE )"\x8B\x07", 2 ) == 0 ) <=== Right?
{
Sleep( 100 );
DetourCreate( ( PBYTE )DIPEngine, ( PBYTE )DIPEngineMidfunction, 7 ); <== Right?
}
Sleep( 50 );
}

return 0;
}