Crossfire Hook [ WE11ington ]

#include <windows.h>
#include <stdio.h>
#include <d3d9.h>
#include <d3dx9.h>

#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "d3dx9.lib")

#define ResetEngine 0x00454B55
DWORD retResetEngine = ( ResetEngine + 0x5 );

#define PresentEngine 0x004C7CEF
DWORD retPresentEngine = ( PresentEngine + 0x5 );
// http://www.unknowncheats.me/forum/crossfire/79420-hook-present-engine.html

#define BeginSceneEngine 0x00455ECE
DWORD retBeginSceneEngine = ( BeginSceneEngine + 0x8 );

#define EndSceneEngine 0x00455FAF
DWORD retEndSceneEngine = ( EndSceneEngine + 0x8 );
// http://www.unknowncheats.me/forum/crossfire/79135-hook-endscene-engine.html

#define DIPEngine1 0x004B766D
DWORD retDIPEngine1 = ( DIPEngine1 + 0x8 );
// http://www.unknowncheats.me/forum/crossfire/78917-hook-dip-engine.html

#define DIPEngine2 0x004B2F22
DWORD retDIPEngine2 = ( DIPEngine2 + 0x8 );
// http://www.unknowncheats.me/forum/crossfire/79265-hook-dip-engine-2-a.html

LPD3DXFONT myFont;

VOID StartFont( LPDIRECT3DDEVICE9 pDevice )
{
    if( myFont )
    {
        myFont->Release();
        myFont = 0;
    }

    if( !myFont )
    {
        D3DXCreateFont( pDevice,
                14,
                6,
                FW_BOLD,
                1,
                0,
                DEFAULT_CHARSET,
                OUT_DEFAULT_PRECIS,
                ANTIALIASED_QUALITY,
                DEFAULT_PITCH | FF_DONTCARE,
                "Arial",
                &myFont );
    }
}

VOID WriteText( LPDIRECT3DDEVICE9 pDevice, INT x, INT y, DWORD color, CHAR *text )
{
    RECT rect;
    SetRect( &rect, x, y, x, y );
    myFont->DrawText( 0, text, -1, &rect, DT_NOCLIP | DT_LEFT, color );
}

__declspec( naked ) HRESULT WINAPI ResetMidfunction( )
{
    static LPDIRECT3DDEVICE9 pDevice;

    __asm
    {
        MOV EDX,DWORD PTR DS:[EAX]
        MOV EDX,DWORD PTR DS:[EDX + 0x40]
        MOV DWORD PTR DS:[pDevice], EAX
        PUSHAD
    }

    // Code Here

    __asm
    {
        POPAD
        JMP retResetEngine
    }
}

__declspec( naked ) HRESULT WINAPI PresentMidfunction( )
{
    static LPDIRECT3DDEVICE9 pDevice;

    __asm
    {
        MOV ECX, DWORD PTR DS:[EAX]
        MOV EDX, DWORD PTR DS:[ECX + 0x44]
        MOV DWORD PTR DS:[pDevice], EAX
        PUSH 0
        PUSHAD
    }

    StartFont( pDevice );

    if( myFont )
        WriteText( pDevice, 300, 300, 0xFFFF0000, "Hook Present Engine" );

    __asm
    {
        POPAD
        JMP retPresentEngine
    }
}

__declspec( naked ) HRESULT WINAPI BeginSceneMidfunction( )
{
    static LPDIRECT3DDEVICE9 pDevice;

    __asm
    {
        MOV ECX, DWORD PTR DS:[EAX]
        MOV EDX, DWORD PTR DS:[ECX + 0xA4]
        MOV DWORD PTR DS:[pDevice], EAX
        PUSHAD
    }

    // Code Here

    __asm
    {
        POPAD
        JMP retBeginSceneEngine
    }
}

__declspec( naked ) HRESULT WINAPI EndSceneMidfunction( )
{
    static LPDIRECT3DDEVICE9 pDevice;

    __asm
    {
        MOV ECX, DWORD PTR DS:[EAX]
        MOV EDX, DWORD PTR DS:[ECX + 0xA8]
        MOV DWORD PTR DS:[pDevice], EAX
        PUSHAD
    }

    StartFont( pDevice );

    if( myFont )
        WriteText( pDevice, 300, 300, 0xFFFF0000, "Hook EndScene Engine" );

    __asm
    {
        POPAD
        JMP retEndSceneEngine
    }
}

__declspec( naked ) HRESULT WINAPI DIPMidfunction1( )
{
    static LPDIRECT3DDEVICE9 pDevice;

    __asm
    {
        MOV EDX, DWORD PTR DS:[EAX]
        MOV EDX, DWORD PTR DS:[EDX + 0x148]
        MOV DWORD PTR DS:[pDevice], EAX
        PUSHAD
    }

    pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE );

    __asm
    {
        POPAD
        JMP retDIPEngine1
    }
}

__declspec( naked ) HRESULT WINAPI DIPMidfunction2( )
{
    static LPDIRECT3DDEVICE9 pDevice;
    static INT BaseVertexIndex;
    static UINT MinVertexIndex, NumVertices, startIndex, primCount;

    __asm
    {
        MOV ECX, DWORD PTR DS:[EAX]
        MOV EDX, DWORD PTR DS:[ECX + 0x148]
        MOV ECX, DWORD PTR DS:[EBP + 0x18]
        MOV DWORD PTR DS:[BaseVertexIndex], ECX
        MOV ECX, DWORD PTR DS:[EBP + 0x8]
        MOV DWORD PTR DS:[MinVertexIndex], ECX
        MOV ECX, DWORD PTR DS:[EBP + 0x10]
        MOV DWORD PTR DS:[NumVertices], ECX
        MOV ECX, DWORD PTR DS:[EBP + 0xC]
        MOV DWORD PTR DS:[startIndex], ECX
        MOV ECX, DWORD PTR DS:[EBP + 0x14]
        MOV DWORD PTR DS:[primCount], ECX
        PUSHAD
    }

    pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE );

    __asm
    {
        POPAD
        JMP retDIPEngine2
    }
}

VOID *DetourCreate( BYTE *src, CONST BYTE *dst, CONST INT len )
{
    BYTE *jmp = ( BYTE * ) malloc( len + 5 );
    DWORD dwBack;

    VirtualProtect( src, len, PAGE_READWRITE, &dwBack );
    memcpy( jmp, src, len );
    jmp += len;
    jmp[0] = 0xE9;
    *( DWORD * )( jmp + 1 ) = ( DWORD )( src + len - jmp ) - 5;

    src[0] = 0xE9;
    *( DWORD * )( src + 1 ) = ( DWORD )( dst - src ) - 5;
    for( INT i = 5; i < len; i++ )
        src[i] = 0x90;
    VirtualProtect( src, len, dwBack, &dwBack );

    return( jmp - len );
}

DWORD WINAPI StartRoutine( LPVOID )
{
    while( TRUE )
    {
        //ResetEngine Detected
        //if( memcmp( ( VOID * )ResetEngine, ( VOID * )( PBYTE )"\x8B\x10", 2 ) == 0 )
        //{
        //  Sleep( 100 );
        //  DetourCreate( ( PBYTE )ResetEngine, ( PBYTE )ResetMidfunction, 5 );
        //}


        //PresentEngine Detected
        //if( memcmp( ( VOID * )PresentEngine, ( VOID * )( PBYTE )"\x8B\x51", 2 ) == 0 )
        //{
        //  Sleep( 100 );
        //  DetourCreate( ( PBYTE )PresentEngine, ( PBYTE )PresentMidfunction, 5 );
        //}


        //PresentEngine Detected
        //if( memcmp( ( VOID * )PresentEngine, ( VOID * )( PBYTE )"\x8B\x51", 2 ) == 0 )
        //{
        //  Sleep( 100 );
        //  DetourCreate( ( PBYTE )( PresentEngine - 0x5 ), ( PBYTE )PresentMidfunction, 5 );
        //  memcpy( ( VOID * )PresentEngine, ( VOID * )( PBYTE )"\x41\xE2\xF8", 3 );
        //}


        //BeginSceneEngine Detected
        //if( memcmp( ( VOID * )BeginSceneEngine, ( VOID * )( PBYTE )"\x8B\x08", 2 ) == 0 )
        //{
        //  Sleep( 100 );
        //  DetourCreate( ( PBYTE )BeginSceneEngine, ( PBYTE )BeginSceneMidfunction, 8 );
        //}


        //EndSceneEngine Detected
        //if( memcmp( ( VOID * )EndSceneEngine, ( VOID * )( PBYTE )"\x8B\x08", 2 ) == 0 )
        //{
        //  Sleep( 100 );
        //  DetourCreate( ( PBYTE )EndSceneEngine, ( PBYTE )EndSceneMidfunction, 8 );
        //}


        //DIPEngine1 Detected
        //if( memcmp( ( VOID * )DIPEngine1, ( VOID * )( PBYTE )"\x8B\x10", 2 ) == 0 )
        //{
        //  Sleep( 100 );
        //  DetourCreate( ( PBYTE )DIPEngine1, ( PBYTE )DIPMidfunction1, 8 );
        //}


        //DIPEngine2 Detected
        //if( memcmp( ( VOID * )DIPEngine2, ( VOID * )( PBYTE )"\x8B\x08", 2 ) == 0 )
        //{
        //  Sleep( 100 );
        //  DetourCreate( ( PBYTE )DIPEngine2, ( PBYTE )DIPMidfunction2, 8 );
        //}

        Sleep( 50 );
    }

    return 0;
}

BOOL WINAPI DllMain( HMODULE hDll, DWORD dwReason, LPVOID lpReserved )
{
    if( dwReason == DLL_PROCESS_ATTACH )
    {
        DisableThreadLibraryCalls( hDll );
        MessageBox( 0, "Hook Engine", "Crossfire", 0 );
        CreateThread( 0, 0, (LPTHREAD_START_ROUTINE)StartRoutine, 0, 0, 0 );
    }

    return TRUE;
}