CrossFire_Project [http://www.unknowncheats.me/forum/]

//================================================================================================================
//  A basic D3D framework
//
//  File Project : d3dbase.cpp
//  Author       : Hans211
//  Date Created : 11 April 2009
//
//  A basic D3D framework:
//      - D3D menu with folders
//      - Using LPD3DXFONT, left - center - right aligned text
//
//  Credits:
//      - People of: DXT, Game-Deception, GHBsys, Unknown Cheats
//
//  Tools used:
//      - Microsoft Visual C++ 2010
//      - Microsoft DirectX SDK (June 2010)
//
//  Features:
//      - Use Insert key to show/hide menu
//      - Use up and down arrow keys to manouvre through the menuitems
//      - Use left and right arrow keys to toggle menuitems
//      - Use Control + arrow keys to move the menu
//      - Items can have multiple custom states like: "Off" "On" or "Head" "Neck" "Spine"
//      - Support for textonly items
//      - Support for folder style items
//================================================================================================================
//  CrossFire: Hook Engine
//
//  Date: 08 September 2012
//
//  Credits:
//      - Menu        -> Hans211
//      - Detour      -> Azorbix
//      - Midfunction -> Shad0w_
//      - Hook Engine -> WE11ington
//================================================================================================================

#include "d3dbase.h"

LPD3DXFONT pFont;

#define PresentEngine       0x004C41AF
DWORD retPresentEngine      = ( PresentEngine + 0x5 );

#define EndSceneEngine      0x00455ECF
DWORD retEndSceneEngine     = ( EndSceneEngine + 0x8 );

#define DIPEngine           0x004B490D
DWORD retDIPEngine          = ( DIPEngine + 0x8 );

VOID StartFont( LPDIRECT3DDEVICE9 pDevice )
{
    if( pFont )
    {
        pFont->Release();
        pFont = 0;
    }

    if( !pFont )
    {
        D3DXCreateFont( pDevice,
                14,
                0,
                FW_BOLD,
                1,
                0,
                DEFAULT_CHARSET,
                OUT_DEFAULT_PRECIS,
                ANTIALIASED_QUALITY,
                DEFAULT_PITCH | FF_DONTCARE,
                "Arial",
                &pFont );
    }
}

__declspec( naked ) HRESULT WINAPI PresentMidfunction( )
{
    static LPDIRECT3DDEVICE9 pDevice;

    __asm
    {
        MOV ECX, DWORD PTR DS:[EAX]
        MOV EDX, DWORD PTR DS:[ECX + 0x44]
        MOV DWORD PTR DS:[pDevice], EAX
        PUSH 0
        PUSHAD
    }

    pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE );

    StartFont( pDevice );
    DoMenu( pDevice );
    DoHackMemory( pDevice );

    pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_TRUE );

    __asm
    {
        POPAD
        JMP retPresentEngine
    }
}

__declspec( naked ) HRESULT WINAPI EndSceneMidfunction( )
{
    static LPDIRECT3DDEVICE9 pDevice;

    __asm
    {
        MOV ECX, DWORD PTR DS:[EAX]
        MOV EDX, DWORD PTR DS:[ECX + 0xA8]
        MOV DWORD PTR DS:[pDevice], EAX
        PUSHAD
    }

    pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE );

    StartFont( pDevice );
    DoMenu( pDevice );
    DoHackMemory( pDevice );

    pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_TRUE );

    __asm
    {
        POPAD
        JMP retEndSceneEngine
    }
}

__declspec( naked ) HRESULT WINAPI DIPMidfunction( )
{
    static LPDIRECT3DDEVICE9 pDevice;

    __asm
    {
        MOV EDX, DWORD PTR DS:[EAX]
        MOV EDX, DWORD PTR DS:[EDX + 0x148]
        MOV DWORD PTR DS:[pDevice], EAX
        PUSHAD
    }

    DoHackDirectx( pDevice );

    __asm
    {
        POPAD
        JMP retDIPEngine
    }
}

VOID *DetourCreate( BYTE *src, CONST BYTE *dst, CONST INT len )
{
    BYTE *jmp = ( BYTE * )malloc( len + 5 );
    DWORD dwBack;

    VirtualProtect( src, len, PAGE_READWRITE, &dwBack );
    memcpy( jmp, src, len );
    jmp += len;
    jmp[0] = 0xE9;
    *( DWORD * )( jmp + 1 ) = ( DWORD )( src + len - jmp ) - 5;

    src[0] = 0xE9;
    *( DWORD * )( src + 1 ) = ( DWORD )( dst - src ) - 5;
    for( INT i = 5; i < len; i++ )
        src[i] = 0x90;
    VirtualProtect( src, len, dwBack, &dwBack );

    return( jmp - len );
}

DWORD WINAPI D3Dinit( LPVOID )
{
    while( TRUE )
    {
        if( ( memcmp( ( VOID * )PresentEngine , ( VOID * )( PBYTE )"\x8B\x51", 2 ) == 0 ) &&
            ( memcmp( ( VOID * )EndSceneEngine, ( VOID * )( PBYTE )"\x8B\x08", 2 ) == 0 ) &&
            ( memcmp( ( VOID * )DIPEngine     , ( VOID * )( PBYTE )"\x8B\x10", 2 ) == 0 ) )
        {
            Sleep( 50 );
            //DetourCreate( ( PBYTE )PresentEngine , ( PBYTE )PresentMidfunction , 5 );
            DetourCreate( ( PBYTE )EndSceneEngine, ( PBYTE )EndSceneMidfunction, 8 );
            DetourCreate( ( PBYTE )DIPEngine     , ( PBYTE )DIPMidfunction     , 8 );
        }

        Sleep( 50 );
    }

    return 0;
}

BOOL WINAPI DllMain( HMODULE hDll, DWORD dwReason, LPVOID lpReserved )
{
    DisableThreadLibraryCalls( hDll );
    if( dwReason == DLL_PROCESS_ATTACH )
    {
        MessageBox( 0, "CrossFire Project", "HOOK", 0 );
        CreateThread( 0, 0, ( LPTHREAD_START_ROUTINE )D3Dinit, 0, 0, 0 );
    }

    return TRUE;
}