DIP

Posts 1–4 of 4 · Page 1 of 1
DIP
I am working with this wallhack code and i am having a problem. I know that the detour part is detected(i guess). The problem is, when ever i inject it doesn't work. What i mean is when ever the game load, it crushed. and i don't know why. can someone explain or teach me how to fix this. Any help will be appreciated, Thank you.

Base.ccp
Code:
#include <stdio.h>
#include <d3d9.h>
#include <d3dx9.h>
#include "Detour.h"
#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "D3DX9.LIB")

typedef HRESULT ( WINAPI* oDip ) ( LPDIRECT3DDEVICE9 Device, D3DPRIMITIVETYPE A, UINT B, UINT C, UINT D, UINT E, UINT F);
oDip pDip;


HRESULT WINAPI DIP(LPDIRECT3DDEVICE9 Device, D3DPRIMITIVETYPE A, UINT B, UINT C, UINT D, UINT E, UINT F)
{	  
  LPDIRECT3DVERTEXBUFFER9 S;
  UINT O = 0;
  UINT Stride = 0;

  if(Device->GetStreamSource(0, &S, &O, &Stride) == D3D_OK)
  S->Release();

int Wall=1;

if(Wall==1)
 {
  if(Stride == 36)
  {
    Device->SetRenderState(D3DRS_ZENABLE,false);
   }
}

return pDip(Device, A, B, C, D, E, F);
}


int D3D(void)
{
	HINSTANCE	hD3D;
	DWORD		vTable[105];
	hD3D=0;
	do {
		hD3D = GetModuleHandle("d3d9.dll");
		if (!hD3D) Sleep(10);
	} while(!hD3D);

	if (D3Ddiscover((void *)&vTable[0],420)==0) return 0;
	{

		pDip = (oDip)DetourCreate((DWORD)vTable[17], (DWORD)DIP,12);

			
		Sleep(100);
	}

	return 0;
}	



BOOL WINAPI DllMain(HINSTANCE mod, DWORD GameStart, LPVOID res)
{
if( GameStart == DLL_PROCESS_ATTACH )
    {
		EraseHeaders(mod); 
                HideModule(mod);
		CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)D3D, NULL, NULL, NULL);
    }
}
Detour.h
Code:
DWORD DetourCreate( DWORD  SrcVA, DWORD  DstVA, DWORD  Size )
{
	/*Credits for this detour to croner*/
#define SIZEOF_JMP_NEAR  5

	if ( SrcVA && DstVA && Size > 0 )
	{
		DWORD DetourVA = (DWORD) 
			VirtualAlloc( NULL, Size + SIZEOF_JMP_NEAR, 
			MEM_COMMIT | MEM_TOP_DOWN, PAGE_EXECUTE_READWRITE );
		
		if ( DetourVA == 0 )
			return (0);

		DWORD dwProtect;
		if ( VirtualProtect( (VOID*)SrcVA, Size, PAGE_EXECUTE_READWRITE, &dwProtect ) )
		{
			for ( DWORD i=0; i < Size; i++ ) {
				*(BYTE*)( DetourVA + i ) = *(BYTE*)( SrcVA + i );
			}
			
			*(BYTE*)( DetourVA + Size + 0 ) = 0xE9;
			*(DWORD*)( DetourVA + Size + 1 ) = ( SrcVA - DetourVA - SIZEOF_JMP_NEAR );

	    	*(BYTE*)( SrcVA + 0 ) = 0xE9;
			*(DWORD*)( SrcVA + 1 ) = ( DstVA - SrcVA - SIZEOF_JMP_NEAR );

			VirtualProtect( (VOID*)SrcVA, Size, dwProtect, &dwProtect );

			VirtualProtect( (VOID*)DetourVA, Size + 
				SIZEOF_JMP_NEAR, PAGE_EXECUTE_READ, &dwProtect );

	    	return DetourVA;
		}
	}
	return (0);
}




PVOID D3Ddiscover(void *tbl, int size)
{

	
	HWND				  hWnd;
	void				  *pInterface=0 ;
	D3DPRESENT_PARAMETERS d3dpp; 

	if ((hWnd=CreateWindowEx(NULL,WC_DIALOG,"",WS_OVERLAPPED,0,0,50,50,NULL,NULL,NULL,NULL))==NULL) return 0;
	ShowWindow(hWnd, SW_HIDE);

	LPDIRECT3D9			pD3D;
	LPDIRECT3DDEVICE9	pD3Ddev;
	if ((pD3D = Direct3DCreate9(D3D_SDK_VERSION))!=NULL) 

	{
	    ZeroMemory(&d3dpp, sizeof(d3dpp));
	    d3dpp.Windowed         = TRUE;
		d3dpp.SwapEffect       = D3DSWAPEFFECT_DISCARD;
	    d3dpp.hDeviceWindow    = hWnd;
	    d3dpp.BackBufferFormat = D3DFMT_X8R8G8B8;
	    d3dpp.BackBufferWidth  = d3dpp.BackBufferHeight = 600;
		pD3D->CreateDevice(D3DADAPTER_DEFAULT,D3DDEVTYPE_HAL,hWnd,D3DCREATE_SOFTWARE_VERTEXPROCESSING,&d3dpp,&pD3Ddev);
		if (pD3Ddev)  {
		    pInterface = (PDWORD)*(DWORD *)pD3Ddev;
			memcpy(tbl,(void *)pInterface,size);
			pD3Ddev->Release();
		}
		pD3D->Release();
	}
	DestroyWindow(hWnd);
	return pInterface;
}

void EraseHeaders(HINSTANCE hModule)
{
	/* 
	* jus a func to erase headers by Croner.
	* keep in mind you wont be able to load 
	* any resources after you erase headers.
	*/

	PIMAGE_DOS_HEADER pDoH; 
	PIMAGE_NT_HEADERS pNtH;
	DWORD i, ersize, protect;

	if (!hModule) return;
	
	// well just to make clear what we doing
	pDoH = (PIMAGE_DOS_HEADER)(hModule);

	pNtH = (PIMAGE_NT_HEADERS)((LONG)hModule + ((PIMAGE_DOS_HEADER)hModule)->e_lfanew);

	ersize = sizeof(IMAGE_DOS_HEADER);
	if ( VirtualProtect(pDoH, ersize, PAGE_READWRITE, &protect) )
	{
		for ( i=0; i < ersize; i++ )
				*(BYTE*)((BYTE*)pDoH + i) = 0;
	}

	ersize = sizeof(IMAGE_NT_HEADERS);
	if ( pNtH && VirtualProtect(pNtH, ersize, PAGE_READWRITE, &protect) )
	{
		for ( i=0; i < ersize; i++ )
				*(BYTE*)((BYTE*)pNtH + i) = 0;
	}
	return;
}


void HideModule(HINSTANCE hModule)/*Credits to Thanatos aka Surpintine for his hide module function*/
{
	DWORD dwPEB_LDR_DATA = 0;
	_asm
	{
		pushad;
		pushfd;
		mov eax, fs:[30h]             
		mov eax, [eax+0Ch]               
		mov dwPEB_LDR_DATA, eax	

		InLoadOrderModuleList:
			mov esi, [eax+0Ch]	     
			mov edx, [eax+10h]	     

		LoopInLoadOrderModuleList: 
		    lodsd		         
			mov esi, eax	
			mov ecx, [eax+18h]  
			cmp ecx, hModule	
			jne SkipA		 
		    mov ebx, [eax]	  
		    mov ecx, [eax+4]  
		    mov [ecx], ebx    
		    mov [ebx+4], ecx	  
			jmp InMemoryOrderModuleList 

		SkipA:
			cmp edx, esi     
			jne LoopInLoadOrderModuleList

		InMemoryOrderModuleList:
			mov eax, dwPEB_LDR_DATA
			mov esi, [eax+14h]
			mov edx, [eax+18h]

		LoopInMemoryOrderModuleList: 
			lodsd
			mov esi, eax
			mov ecx, [eax+10h]
			cmp ecx, hModule
			jne SkipB
			mov ebx, [eax] 
			mov ecx, [eax+4]
			mov [ecx], ebx
			mov [ebx+4], ecx
			jmp InInitializationOrderModuleList

		SkipB:
			cmp edx, esi
			jne LoopInMemoryOrderModuleList

		InInitializationOrderModuleList:
			mov eax, dwPEB_LDR_DATA
			mov esi, [eax+1Ch]	  
			mov edx, [eax+20h]	  

		LoopInInitializationOrderModuleList: 
			lodsd
			mov esi, eax		
			mov ecx, [eax+08h]
			cmp ecx, hModule		
			jne SkipC
			mov ebx, [eax] 
			mov ecx, [eax+4]
			mov [ecx], ebx
			mov [ebx+4], ecx
			jmp Finished

		SkipC:
			cmp edx, esi
			jne LoopInInitializationOrderModuleList

		Finished:
			popfd;
			popad;
	}
}
I'm not an expert in hooking, but I think the problem is you are hooking a DIP function in present (based on your vTable value)
Here's the part I'm talking about:
Code:
pDip = (oDip)DetourCreate((DWORD)vTable[17], (DWORD)DIP,12);
The vTable value of present hooks is 17, while DIP's is 82
source: http://www.mpgh.net/forum/showthread.php?t=185844
Quote Originally Posted by Ryuzaki2 View Post
I'm not an expert in hooking, but I think the problem is you are hooking a DIP function in present (based on your vTable value)
Here's the part I'm talking about:
Code:
pDip = (oDip)DetourCreate((DWORD)vTable[17], (DWORD)DIP,12);
The vTable value of present hooks is 17, while DIP's is 82
source: http://www.mpgh.net/forum/showthread.php?t=185844
Thank you so much, it solved my problem. The only problem left now is how to make it undetected
Posts 1–4 of 4 · Page 1 of 1
This thread is closed for replies.

Similar Threads

Tags for this Thread

None

Talk with us