ghost recon phantoms d3d hack

//ghost recon phantoms hack by Nseven
//credits: scrapdizle, ntKid, Citadell, s0beit, google

#include <Windows.h>
#include <fstream>
#include <vector>
#include <d3d9.h>
#include <d3dx9.h>
#pragma comment (lib, "d3dx9.lib")
#pragma comment (lib, "d3d9.lib")
#include <detours.h>
using namespace std;

//=====================================================================================

// settings
DWORD aimkey = VK_SHIFT;            //aimkey
int aimfov = 25;                //aim fov in %
float aimheight = 1.2f;             //adjust aim height, 0 = feet
int aimsens = 3;                //aimsensitivity (high aim sensitivity is for high mouse sensitivity)

//device
LPDIRECT3DDEVICE9 Device;

//init once
bool FirstInit = false;

//vertexshader
//IDirect3DVertexShader9* vShader;
//UINT vSize;

//models
bool BODY;
bool HEAD;

//viewport
D3DVIEWPORT9 Viewport;

//
UINT mStartRegister;
UINT mVector4fCount;

//=====================================================================================

typedef HRESULT (WINAPI* tDrawIndexedPrimitive)(LPDIRECT3DDEVICE9 Device, D3DPRIMITIVETYPE PrimType,INT BaseVertexIndex,UINT MinVertexIndex,UINT NumVertices,UINT startIndex,UINT primCount);
tDrawIndexedPrimitive oDrawIndexedPrimitive;

typedef HRESULT (WINAPI* tEndScene)(LPDIRECT3DDEVICE9 Device);
tEndScene oEndScene;

typedef HRESULT (WINAPI* tReset) (LPDIRECT3DDEVICE9 Device, D3DPRESENT_PARAMETERS *pPresentationParameters);
tReset oReset;

typedef HRESULT(__stdcall* tCreateQuery)(LPDIRECT3DDEVICE9 Device, D3DQUERYTYPE Type, IDirect3DQuery9** ppQuery);
tCreateQuery oCreateQuery;

typedef HRESULT(__stdcall* tSetVertexShaderConstantF)(LPDIRECT3DDEVICE9 Device, UINT StartRegister, const float *pConstantData, UINT Vector4fCount);
tSetVertexShaderConstantF oSetVertexShaderConstantF;

//=====================================================================================

LPDIRECT3DTEXTURE9    texRed, texYellow, texBlue;
HRESULT GenerateTexture(IDirect3DDevice9 *pD3Ddev, IDirect3DTexture9 **ppD3Dtex, DWORD colour32)
{
    if (FAILED(pD3Ddev->CreateTexture(8, 8, 1, 0, D3DFMT_A4R4G4B4, D3DPOOL_MANAGED, ppD3Dtex, NULL)))
        return E_FAIL;

    WORD colour16 = ((WORD)((colour32 >> 28) & 0xF) << 12)
        | (WORD)(((colour32 >> 20) & 0xF) << 8)
        | (WORD)(((colour32 >> 12) & 0xF) << 4)
        | (WORD)(((colour32 >> 4) & 0xF) << 0);

    D3DLOCKED_RECT d3dlr;
    (*ppD3Dtex)->LockRect(0, &d3dlr, 0, 0);
    WORD *pDst16 = (WORD*)d3dlr.pBits;

    for (int xy = 0; xy < 8 * 8; xy++)
        *pDst16++ = colour16;

    (*ppD3Dtex)->UnlockRect(0);

    return S_OK;
}

//=====================================================================================

void DrawPoint(LPDIRECT3DDEVICE9 Device, int baseX, int baseY, int baseW, int baseH, D3DCOLOR Cor)
{
    D3DRECT BarRect = { baseX, baseY, baseX + baseW, baseY + baseH };
    Device->Clear(1, &BarRect, D3DCLEAR_TARGET | D3DCLEAR_ZBUFFER, Cor, 0, 0);
}

void DrawCornerBox(LPDIRECT3DDEVICE9 Device, int x, int y, int w, int h, int borderPx, DWORD borderColor) //with x,y being the center of the box
{
    DrawPoint(Device, x - (w / 2), (y - h + borderPx), w / 3, borderPx, borderColor); //bottom
    DrawPoint(Device, x - (w / 2) + w - w / 3, (y - h + borderPx), w / 3, borderPx, borderColor); //bottom
    DrawPoint(Device, x - (w / 2), (y - h + borderPx), borderPx, w / 3, borderColor); //left
    DrawPoint(Device, x - (w / 2), (y - h + borderPx) + h - w / 3, borderPx, w / 3, borderColor); //left
    DrawPoint(Device, x - (w / 2), y, w / 3, borderPx, borderColor); //top
    DrawPoint(Device, x - (w / 2) + w - w / 3, y, w / 3, borderPx, borderColor); //top
    DrawPoint(Device, (x + w - borderPx) - (w / 2), (y - h + borderPx), borderPx, w / 3, borderColor);//right
    DrawPoint(Device, (x + w - borderPx) - (w / 2), (y - h + borderPx) + h - w / 3, borderPx, w / 3, borderColor);//right
}

//=====================================================================================

//   Name               Reg   Size
//   ------------------ ----- ----
//   g_mObjectToView    c0       3
//   g_mProjection      c4       4
//   gaf_UnpackPosInfos c118     1

struct ModelInfo_t
{
    D3DXVECTOR3 Position2D;
    D3DXVECTOR3 Position3D;
    float CrosshairDistance;
};
std::vector<ModelInfo_t*>ModelInfo;

float GetDistance(float Xx, float Yy, float xX, float yY)
{
    return sqrt((yY - Yy) * (yY - Yy) + (xX - Xx) * (xX - Xx));
}

void Worldtoscreen(LPDIRECT3DDEVICE9 Device)
{
    ModelInfo_t* pModel = new ModelInfo_t;

    D3DXMATRIX g_mProjection, g_mObjectToView, BSMatrix;
    D3DXVECTOR3 VectorMiddle(0, 0, 0), ScreenMiddle(0, 0, (float)aimheight);
    pModel->Position3D = ScreenMiddle;

    Device->GetVertexShaderConstantF(4, g_mProjection, 4);
    Device->GetVertexShaderConstantF(0, g_mObjectToView, 3);

    D3DXMatrixIdentity(&BSMatrix);
    D3DXMatrixTranspose(&g_mObjectToView, &g_mObjectToView);
    D3DXMatrixTranspose(&g_mProjection, &g_mProjection);

    //D3DXVec3Unproject(&VectorMiddle, &ScreenMiddle, &Viewport, &g_mProjection, &g_mObjectToView, &BSMatrix);
    D3DXVec3Project(&VectorMiddle, &pModel->Position3D, &Viewport, &g_mProjection, &g_mObjectToView, &BSMatrix);

        pModel->Position2D.x = VectorMiddle.x;
        pModel->Position2D.y = VectorMiddle.y;

    ModelInfo.push_back(pModel);
    //delete[] pModel;
}

//=====================================================================================

HRESULT __stdcall hkSetVertexShaderConstantF(LPDIRECT3DDEVICE9 Device, UINT StartRegister, const float *pConstantData, UINT Vector4fCount)
{
    HRESULT hRet;

    if (Device == nullptr)
    return oSetVertexShaderConstantF(Device, StartRegister, pConstantData, Vector4fCount);

    if (pConstantData == NULL)
        return oSetVertexShaderConstantF(Device, StartRegister, pConstantData, Vector4fCount);

    hRet = (HRESULT)oSetVertexShaderConstantF(Device, StartRegister, pConstantData, Vector4fCount);

    if (SUCCEEDED(hRet))
    {
        mStartRegister = StartRegister;
        mVector4fCount = Vector4fCount;
    }

    return hRet;
}

//=====================================================================================

HRESULT WINAPI hkDrawIndexedPrimitive(LPDIRECT3DDEVICE9 Device, D3DPRIMITIVETYPE PrimType,INT BaseVertexIndex,UINT MinVertexIndex,UINT NumVertices,UINT startIndex,UINT primCount)
{
    //HRESULT hRet;

    if (FirstInit == FALSE)
    {
        GenerateTexture(Device, &texRed, D3DCOLOR_ARGB(255, 255, 0, 0));
        GenerateTexture(Device, &texYellow, D3DCOLOR_ARGB(255, 255, 255, 0));
        GenerateTexture(Device, &texBlue, D3DCOLOR_ARGB(255, 0, 0, 255));

        FirstInit = TRUE;
    }

    /*
    //get vSize
    hRet = Device->GetVertexShader(&vShader);
    if (SUCCEEDED(hRet) && vShader != NULL)
    {
        hRet = vShader->GetFunction(NULL, &vSize);
        if (SUCCEEDED(hRet) && vShader != NULL)
        {
            vShader->Release();
            vShader = NULL;
        }
    }

    //model rec
    //body near         //video settings
    if ((vSize == 3712) ||      //high
    (vSize == 3404)         //med, low & very low
    ||
    //body far
    (vSize == 2524) ||      //med & high
    (vSize == 2488))        //low & very low
    BODY = true;
    else BODY = false;

    //head near         //video settings
    if ((vSize == 3592) ||      //high
    (vSize == 3308)         //med, low & very low
    ||
    //head far
    (vSize == 3308) ||      //med & high
    (vSize == 3272) ||      //low & very low
    (vSize == 3672))        //main menu chara
    HEAD = true;
    else HEAD = false;
    */

    //head
    if (mStartRegister == 128)
        HEAD = true;
    else HEAD = false;

    //body
    if (mStartRegister == 192 || mStartRegister == 131)
        BODY = true;
    else BODY = false;

    //worldtoscreen (head chams can f.up aim)
    if (HEAD)
    {
        Worldtoscreen(Device);
    }

    //chams
    if (BODY)
    {
        Device->SetTexture(0, texRed);
        //Device->SetTexture(1, texRed);
        Device->SetRenderState(D3DRS_ZENABLE, D3DZB_FALSE);
        oDrawIndexedPrimitive(Device, PrimType, BaseVertexIndex, MinVertexIndex, NumVertices, startIndex, primCount);
        Device->SetRenderState(D3DRS_ZENABLE, D3DZB_TRUE);
        Device->SetTexture(0, texBlue);
    }

    return oDrawIndexedPrimitive(Device, PrimType, BaseVertexIndex, MinVertexIndex, NumVertices, startIndex, primCount);
}

//=====================================================================================

HRESULT WINAPI hkEndScene(LPDIRECT3DDEVICE9 Device)
{
    //aimbot & esp
    Device->GetViewport(&Viewport);
    if (ModelInfo.size() != NULL)
    {
        UINT BestTarget = -1;
        DOUBLE fClosestPos = 99999;

        for (size_t i = 0; i < ModelInfo.size(); i += 1)
        {
            //drawbox on targets (Esp)
            if (ModelInfo[i]->Position2D.x > 1 || ModelInfo[i]->Position2D.y > 1)
            {
                DrawCornerBox(Device, (int)ModelInfo[i]->Position2D.x, (int)ModelInfo[i]->Position2D.y+20, 20, 30, 1, D3DCOLOR_ARGB(255, 255, 255, 0));
            }

            //get screen center
            float ScreenCenterX = Viewport.Width / 2.0f;
            float ScreenCenterY = Viewport.Height / 2.0f;

            //aimfov
            float radiusx = aimfov * (ScreenCenterX / 100);
            float radiusy = aimfov * (ScreenCenterY / 100);

            //get crosshairdistance
            ModelInfo[i]->CrosshairDistance = GetDistance(ModelInfo[i]->Position2D.x, ModelInfo[i]->Position2D.y, ScreenCenterX, ScreenCenterY);

            //if in fov
            if (ModelInfo[i]->Position2D.x >= ScreenCenterX - radiusx && ModelInfo[i]->Position2D.x <= ScreenCenterX + radiusx && ModelInfo[i]->Position2D.y >= ScreenCenterY - radiusy && ModelInfo[i]->Position2D.y <= ScreenCenterY + radiusy)

                //get closest/nearest target to crosshair
                if (ModelInfo[i]->CrosshairDistance < fClosestPos)
                {
                fClosestPos = ModelInfo[i]->CrosshairDistance;
                BestTarget = i;
                }
        }

        //if nearest target to crosshair
        if (BestTarget != -1)
        {
            double DistX = ModelInfo[BestTarget]->Position2D.x - Viewport.Width / 2.0f;
            double DistY = ModelInfo[BestTarget]->Position2D.y - Viewport.Height / 2.0f;

            //aimsmooth
            DistX /= aimsens;
            DistY /= aimsens;

            //if aimkey is pressed
            if ((GetAsyncKeyState(aimkey) & 0x8000))
                mouse_event(MOUSEEVENTF_MOVE, (DWORD)DistX, (DWORD)DistY, NULL, NULL); //doaim, move mouse to x & y
        }

        ModelInfo.clear();
    }

    return oEndScene(Device);
}

//=====================================================================================

HRESULT WINAPI hkReset(LPDIRECT3DDEVICE9 Device, D3DPRESENT_PARAMETERS *pPresentationParameters)
{
    HRESULT hRet = oReset(Device, pPresentationParameters);

    if (hRet == D3D_OK)
    {

    }

    if (SUCCEEDED(hRet))
    {

    }

    return hRet;
}

//=====================================================================================

class CFakeQuery : public IDirect3DQuery9
{
public:
    HRESULT WINAPI QueryInterface(REFIID riid, void** ppvObj)
    {
        return D3D_OK;
    }

    ULONG WINAPI AddRef()
    {
        m_ref++;

        return m_ref;
    }

    ULONG WINAPI Release()
    {
        return 1;
    }

    HRESULT WINAPI GetDevice(IDirect3DDevice9 **ppDevice)
    {
        return D3D_OK;
    }

    D3DQUERYTYPE WINAPI GetType()
    {
        return m_type;
    }

    DWORD WINAPI GetDataSize()
    {
        return sizeof(DWORD);
    }

    HRESULT    WINAPI Issue(DWORD dwIssueFlags)
    {
        return D3D_OK;
    }

    HRESULT WINAPI GetData(void* pData, DWORD dwSize, DWORD dwGetDataFlags)
    {
        DWORD* pdwData = (DWORD*)pData;

        *pdwData = 500; //500 pixels visible

        return D3D_OK;
    }

    int                m_ref;
    D3DQUERYTYPE    m_type;
};

//=====================================================================================

HRESULT __stdcall hkCreateQuery(LPDIRECT3DDEVICE9 Device, D3DQUERYTYPE Type, IDirect3DQuery9** ppQuery)
{
    if (Type == D3DQUERYTYPE_OCCLUSION)
    {
        *ppQuery = new CFakeQuery;

        ((CFakeQuery*)*ppQuery)->m_type = Type;

        return D3D_OK;
    }

    return oCreateQuery(Device, Type, ppQuery);
}

//=====================================================================================

LRESULT CALLBACK MsgProc(HWND hwnd,UINT uMsg,WPARAM wParam,LPARAM lParam)
{
    return DefWindowProc(hwnd, uMsg, wParam, lParam);
}

//=====================================================================================

DWORD* pVTable;
void DX_Init(DWORD* table)
{
    WNDCLASSEX wc = { sizeof(WNDCLASSEX),CS_CLASSDC,MsgProc,0L,0L,GetModuleHandle(NULL),NULL,NULL,NULL,NULL,"DX",NULL};
    RegisterClassEx(&wc);
    HWND hWnd = CreateWindow("DX",NULL,WS_OVERLAPPEDWINDOW,100,100,300,300,GetDesktopWindow(),NULL,wc.hInstance,NULL);
    LPDIRECT3D9 pD3D = Direct3DCreate9( D3D_SDK_VERSION );
    D3DPRESENT_PARAMETERS d3dpp;
    ZeroMemory( &d3dpp, sizeof(d3dpp) );
    d3dpp.Windowed = TRUE;
    d3dpp.SwapEffect = D3DSWAPEFFECT_DISCARD;
    d3dpp.BackBufferFormat = D3DFMT_UNKNOWN;

    pD3D->CreateDevice(D3DADAPTER_DEFAULT,D3DDEVTYPE_HAL,hWnd,D3DCREATE_SOFTWARE_VERTEXPROCESSING,&d3dpp,&Device);
    pVTable = (DWORD*)Device;
    pVTable = (DWORD*)pVTable[0];

    DestroyWindow(hWnd);
}

//=====================================================================================

HMODULE hmRendDx9Base = NULL;
DWORD WINAPI DxHook(LPVOID)
{
    DWORD VTable[3] = {0};

    while(hmRendDx9Base == NULL)
    {
        hmRendDx9Base = GetModuleHandleA("d3d9.dll");
        Sleep(250);
    }
    CloseHandle(hmRendDx9Base);

    DX_Init(VTable);
    oDrawIndexedPrimitive = (tDrawIndexedPrimitive)DetourFunction((BYTE*)pVTable[82], (BYTE*)hkDrawIndexedPrimitive);
    oEndScene = (tEndScene)DetourFunction((BYTE*)pVTable[42], (BYTE*)hkEndScene);
    oSetVertexShaderConstantF = (tSetVertexShaderConstantF)DetourFunction((BYTE*)pVTable[94], (BYTE*)hkSetVertexShaderConstantF);
    oCreateQuery = (tCreateQuery)DetourFunction((BYTE*)pVTable[118], (BYTE*)hkCreateQuery);
    //oReset = (tReset)DetourFunction((BYTE*)pVTable[16], (BYTE*)hkReset);
    return 0;
}

//=====================================================================================

BOOL APIENTRY DllMain( HMODULE hModule, DWORD  ulReason, LPVOID lpReserved )
{
    switch (ulReason)
    {
        case DLL_PROCESS_ATTACH:
        {
            DisableThreadLibraryCalls(hModule);

            CreateThread(NULL, NULL, DxHook, NULL, NULL, NULL);
        }
        break;
        case DLL_PROCESS_DETACH:
        case DLL_THREAD_ATTACH:
        case DLL_THREAD_DETACH:
        break;
        }
    return TRUE;
}

//http://i60.tinypic.com/2q3w0gh.jpg