EndScene Interface Combat Arms Hook Engine

Bem, o @luizimloko postou esse método de hook para o CrossFire, e nunca vi ele para Combat Arms, então resolvi compartilhar com vocês.
Isso é nada mais que o modo alternativo de fazer hook.
Essa hook suporta: Draw, Font, etc.
Obs: O hook só funciona se usar o Bypass ASM Memory. (:

Code:

#define ADDR_DEVICE                  0x8DE500
#define EndSceneInterfaceEngine   0x005A7297

DWORD retEndSceneInterfaceEngine = ( EndSceneInterfaceEngine + 0x7 );

__declspec( naked ) HRESULT WINAPI EndSceneInterfaceMidfunction( )
{
    static LPDIRECT3DDEVICE9 pDevice;

    __asm
	{
		MOV EAX, DWORD PTR FS:[0]
		PUSH EAX
		PUSHAD
	}

	pDevice = **(LPDIRECT3DDEVICE9 **)ADDR_DEVICE;

	if( D3DDirectxFont )
	{
		DrawText( 50, 60, Red, "Combat Amrs: Hook EndScene Interface Engine" );
		DrawText( 50, 75, Blue,"Créditos:  luizimloko , Shad0w_ e ForeverRed  " );
	}

	FillRGB( 50, 100, 10,10, Red, pDevice );
	FillRGB( 50, 115, 10,10, Green, pDevice );
	FillRGB( 50, 130, 10,10, Blue, pDevice );

    __asm
    {
        POPAD
        JMP [retEndSceneInterfaceEngine]
    }
}


DWORD WINAPI StartRoutine( LPVOID )
{
    while( TRUE )
    {
        if( memcmp( ( VOID * )EndSceneInterfaceEngine, ( VOID * )( PBYTE )"\x64\xA1\x00\x00\x00\x00", 6 ) == 0 )
        {
            Sleep( 100 );
            DetourCreate( ( PBYTE )EndSceneInterfaceEngine, ( PBYTE )EndSceneInterfaceMidfunction, 7 );
        }
        Sleep( 50 );
    } 
    return 0;
}

Code:

005A7290  /$ 6A FF          PUSH -1
005A7292  |. 68 488F7100    PUSH CA.00718F48
005A7297  |. 64:A1 00000000 MOV EAX,DWORD PTR FS:[0] <- EndScene Interface
005A729D  |. 50             PUSH EAX
005A729E  |. 51             PUSH ECX <- Retorno da Hook
005A729F  |. 53             PUSH EBX
005A72A0  |. A1 84BC7C00    MOV EAX,DWORD PTR DS:[7CBC84]
005A72A5  |. 33C4           XOR EAX,ESP
005A72A7  |. 50             PUSH EAX
005A72A8  |. 8D4424 0C      LEA EAX,DWORD PTR SS:[ESP+C]
005A72AC  |. 64:A3 00000000 MOV DWORD PTR FS:[0],EAX
005A72B2  |. B9 84E68D00    MOV ECX,CA.008DE684
005A72B7  |. C74424 08 84E6>MOV DWORD PTR SS:[ESP+8],CA.008DE684
005A72BF  |. E8 6CFBF1FF    CALL CA.004C6E30
005A72C4  |. 33DB           XOR EBX,EBX
005A72C6  |. 895C24 14      MOV DWORD PTR SS:[ESP+14],EBX
005A72CA  |. 381D 80E68D00  CMP BYTE PTR DS:[8DE680],BL
005A72D0  |. 74 46          JE SHORT CA.005A7318
005A72D2  |. A1 00E58D00    MOV EAX,DWORD PTR DS:[8DE500] <- Device Game
005A72D7  |. 3BC3           CMP EAX,EBX
005A72D9  |. 74 3D          JE SHORT CA.005A7318
005A72DB  |. 881D 80E68D00  MOV BYTE PTR DS:[8DE680],BL
005A72E1  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]
005A72E3  |. 8B08           MOV ECX,DWORD PTR DS:[EAX]
005A72E5  |. 8B91 A8000000  MOV EDX,DWORD PTR DS:[ECX+A8]<- Endscene Engine
005A72EB  |. 50             PUSH EAX
005A72EC  |. FFD2           CALL EDX
005A72EE  |. 3BC3           CMP EAX,EBX
005A72F0  |. B9 84E68D00    MOV ECX,CA.008DE684
005A72F5  |. 0F94C3         SETE BL
005A72F8  |. C74424 14 FFFF>MOV DWORD PTR SS:[ESP+14],-1
005A7300  |. E8 3BFBF1FF    CALL CA.004C6E40
005A7305  |. 8AC3           MOV AL,BL
005A7307  |. 8B4C24 0C      MOV ECX,DWORD PTR SS:[ESP+C]
005A730B  |. 64:890D 000000>MOV DWORD PTR FS:[0],ECX
005A7312  |. 59             POP ECX
005A7313  |. 5B             POP EBX
005A7314  |. 83C4 10        ADD ESP,10
005A7317  |. C3             RETN
005A7318  |> B9 84E68D00    MOV ECX,CA.008DE684
005A731D  |. C74424 14 FFFF>MOV DWORD PTR SS:[ESP+14],-1
005A7325  |. E8 16FBF1FF    CALL CA.004C6E40
005A732A  |. 32C0           XOR AL,AL
005A732C  |. 8B4C24 0C      MOV ECX,DWORD PTR SS:[ESP+C]
005A7330  |. 64:890D 000000>MOV DWORD PTR FS:[0],ECX
005A7337  |. 59             POP ECX
005A7338  |. 5B             POP EBX
005A7339  |. 83C4 10        ADD ESP,10
005A733C  \. C3             RETN

Binary Scan:

Code:

A1 ?? ?? ?? ?? 50 51 53 A1 ?? ?? ?? ?? 33 C4 50 8D 44 24 0C 64 A3 ?? ?? ?? ?? B9 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 DB 89 5C 24 14 38 1D 80 E6 8D ?? 74 46

Créditos:
Shad0w_
@luizimloko
@6ixth