EndScene Engine Hook

__declspec( naked ) HRESULT WINAPI EndSceneMidfunction( VOID )
{
	static LPDIRECT3DDEVICE9 pDevice;

	__asm
	{
		MOV ECX, DWORD PTR DS:[EAX]
		MOV EDX, DWORD PTR DS:[ECX + 0xA8]
		MOV DWORD PTR DS:[pDevice], EAX
		PUSH EAX
		CALL EDX
		PUSHAD
	}



	__asm
	{
		POPAD
		RETN
	}
}

DWORD FindPattern( DWORD dwStart, DWORD dwLen, BYTE* pszPatt, CHAR pszMask[] )
{
	// Credits: Gellin.

	UINT i = NULL;
	INT iLen = strlen(pszMask) - 1;

	for( DWORD dwRet = dwStart; dwRet < dwStart + dwLen; dwRet++ )
	{
		if( *(BYTE*)dwRet == pszPatt[i] || pszMask[i] == '?' )
		{
			if( pszMask[i+1] == '\0' )
				return( dwRet - iLen );
			i++;
		} 
		else 
			i = NULL;
	}
	return NULL;
}

void *DetourCreate( BYTE *src, const BYTE *dst, const int len )
{
	BYTE *jmp = (BYTE*)malloc( len+5 );
	DWORD dwBack;
	VirtualProtect( src, len, PAGE_EXECUTE_READWRITE, &dwBack );
	memcpy( jmp, src, len );	
	jmp += len;
	jmp[0] = 0xE9;
	*(DWORD*)( jmp+1 ) = (DWORD)( src+len - jmp ) - 5;
	src[0] = 0xE9;
	*(DWORD*)( src+1 ) = (DWORD)( dst - src ) - 5;
	VirtualProtect( src, len, dwBack, &dwBack );
	FlushInstructionCache( GetCurrentProcess(), src, 0x10 );

	return( jmp-len );
}

DWORD WINAPI D3DHook( PVOID )
{

	DWORD EndScene;

	do
	{
		DWORD WarRock = (DWORD)GetModuleHandle( "WarRock.exe" );

		if( WarRock != NULL )
			EndScene = FindPattern( WarRock, 0x6CD000, (PBYTE)"\x8B\x08\x8B\x91\x00\x00\x00\x00\x50\xFF\xD2\xC3\xCC\xCC\xCC\xCC\xCC\xCC\xCC\xCC\xCC\xCC\xCC\xCC\xCC\xCC\x8B\x80\x00\x00\x00\x00\x8B\x08\x52", "xxxx????xxxxxxxxxxxxxxxxxxxx????xxx" );
	}
	while( !EndScene );

	DetourCreate( (DWORD)EndScene, (PBYTE)EndSceneMidfunction, 8 );

	return FALSE;
}

BOOL WINAPI DllMain( HMODULE hModule, DWORD dwReason, LPVOID lpReserved )
{
	if( dwReason == DLL_PROCESS_ATTACH )
	{
		CreateThread( 0, 0, &D3DHook, 0, 0, 0 );
	}

	return TRUE;
}