i want update the code for test my first hack. but did not working in the game.
Code:
#include <windows.h>
#include <d3d9.h>
#include <d3dx9.h>
#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "d3dx9.lib")
// NUMPAD1 => wallhack.
// NUMPAD2 => color.
#define DIPEngine 0x00459898
DWORD retDIPEngine = ( DIPEngine + 0x8 );
INT chams;
INT color;
#define Red D3DCOLOR_ARGB( 255, 255, 000, 000 )
#define Green D3DCOLOR_ARGB( 255, 000, 255, 000 )
#define Blue D3DCOLOR_ARGB( 255, 000, 000, 255 )
#define Black D3DCOLOR_ARGB( 255, 000, 000, 000 )
__declspec( naked ) HRESULT WINAPI DIPMidfunction( )
{
static LPDIRECT3DDEVICE9 pDevice;
static INT BaseVertexIndex;
static UINT MinVertexIndex, NumVertices, startIndex, primCount;
__asm
{
MOV ECX, DWORD PTR DS:[EAX]
MOV EDX, DWORD PTR DS:[ECX + 0x148]
MOV DWORD PTR DS:[pDevice], EAX
MOV ECX, DWORD PTR DS:[EBP + 0x18]
MOV DWORD PTR DS:[BaseVertexIndex], ECX
MOV ECX, DWORD PTR DS:[EBP + 0x8]
MOV DWORD PTR DS:[MinVertexIndex], ECX
MOV ECX, DWORD PTR DS:[EBP + 0x10]
MOV DWORD PTR DS:[NumVertices], ECX
MOV ECX, DWORD PTR DS:[EBP + 0xC]
MOV DWORD PTR DS:[startIndex], ECX
MOV ECX, DWORD PTR DS:[EBP + 0x14]
MOV DWORD PTR DS:[primCount], ECX
PUSHAD
}
if( GetAsyncKeyState(VK_NUMPAD1)&1 )
chams = !chams;
if( GetAsyncKeyState(VK_NUMPAD2)&1 )
color++;
if( color > 4 )
color = 0;
if( chams )
{
pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE );
if( color == 1 ) pDevice->SetRenderState( D3DRS_AMBIENT, Red );
if( color == 2 ) pDevice->SetRenderState( D3DRS_AMBIENT, Green );
if( color == 3 ) pDevice->SetRenderState( D3DRS_AMBIENT, Blue );
if( color == 4 ) pDevice->SetRenderState( D3DRS_AMBIENT, Black );
}
__asm
{
POPAD
JMP retDIPEngine
}
}
VOID *DetourCreate( BYTE *src, CONST BYTE *dst, CONST INT len )
{
BYTE *jmp =( BYTE * ) malloc( len + 5 );
DWORD dwBack;
VirtualProtect( src, len, PAGE_READWRITE, &dwBack );
memcpy( jmp, src, len );
jmp += len;
jmp[0] = 0xE9;
*( DWORD * )( jmp + 1 ) = ( DWORD )( src + len - jmp ) - 5;
src[0] = 0xE9;
*( DWORD * )( src + 1 ) = ( DWORD )( dst - src ) - 5;
for( INT i = 5; i < len; i++ )
src[i] = 0x90;
VirtualProtect( src, len, dwBack, &dwBack );
return( jmp - len );
}
DWORD WINAPI StartRoutine( LPVOID )
{
while( TRUE )
{
if( memcmp( ( VOID * )DIPEngine, ( VOID * )( PBYTE )"\x8B\x08", 2 ) == 0 )
{
Sleep( 100 );
DetourCreate( ( PBYTE )DIPEngine, ( PBYTE )DIPMidfunction, 8 );
}
Sleep( 50 );
}
return 0;
}
BOOL WINAPI DllMain( HMODULE hDll, DWORD dwReason, LPVOID lpReserved )
{
if( dwReason == DLL_PROCESS_ATTACH )
{
DisableThreadLibraryCalls( hDll );
MessageBox( 0, "num 1 wallhack 2 color, "Crossfire", 0 );
CreateThread( 0, 0, (LPTHREAD_START_ROUTINE)StartRoutine, 0, 0, 0 );
}
return TRUE;
}
Code:
0045986F CC INT3
00459870 57 PUSH EDI
00459871 890E MOV DWORD PTR DS:[ESI],ECX
00459873 A1 70167100 MOV EAX,DWORD PTR DS:[711670]
00459878 8B00 MOV EAX,DWORD PTR DS:[EAX]
0045987A 8B10 MOV EDX,DWORD PTR DS:[EAX]
0045987C 8D7E 04 LEA EDI,DWORD PTR DS:[ESI+4]
0045987F 57 PUSH EDI
00459880 51 PUSH ECX
00459881 50 PUSH EAX
00459882 8B82 E8000000 MOV EAX,DWORD PTR DS:[EDX+E8]
00459888 FFD0 CALL EAX
0045988A 8B0D 70167100 MOV ECX,DWORD PTR DS:[711670]
00459890 8B01 MOV EAX,DWORD PTR DS:[ECX]
00459892 8B4C24 08 MOV ECX,DWORD PTR SS:[ESP+8]
00459896 8B10 MOV EDX,DWORD PTR DS:[EAX]
00459898 8B92 E4000000 MOV EDX,DWORD PTR DS:[EDX+E4]DrawIndexedPrimitive=>DIPEngine??
0045989E 51 PUSH ECX
0045989F 8B0E MOV ECX,DWORD PTR DS:[ESI]
004598A1 51 PUSH ECX
004598A2 50 PUSH EAX
004598A3 FFD2 CALL EDX
004598A5 8BC6 MOV EAX,ESI
004598A7 5F POP EDI
004598A8 C2 0400 RETN 4
004598AB CC INT3
004598AC CC INT3
004598AD CC INT3
004598AE CC INT3