Guest User

D3d9.dll drawindexedprimitive hook cross fire

a guest
Jan 7th, 2013
436
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.64 KB | None | 0 0
  1. #include <windows.h>
  2. #include <d3d9.h>
  3. #include <d3dx9.h>
  4.  
  5. #pragma comment(lib, "d3d9.lib")
  6. #pragma comment(lib, "d3dx9.lib")
  7.  
  8. DWORD DIPD3D9, retDIPD3D9;
  9.  
  10. __declspec( naked ) HRESULT WINAPI DIPMidfunction( )
  11. {
  12. static LPDIRECT3DDEVICE9 pDevice;
  13.  
  14. __asm
  15. {
  16. MOV EDI, EDI
  17. PUSH EBP
  18. MOV EBP, ESP
  19. MOV EAX, DWORD PTR SS:[EBP + 0x8]
  20. MOV DWORD PTR DS:[pDevice], EAX
  21. }
  22.  
  23. pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE );
  24.  
  25. __asm
  26. {
  27. POP EBP
  28. JMP retDIPD3D9
  29. }
  30. }
  31.  
  32. VOID *DetourCreate( BYTE *src, CONST BYTE *dst, CONST INT len )
  33. {
  34. BYTE *jmp =( BYTE * ) malloc( len + 5 );
  35. DWORD dwBack;
  36.  
  37. VirtualProtect( src, len, PAGE_READWRITE, &dwBack );
  38. memcpy( jmp, src, len );
  39. jmp += len;
  40. jmp[0] = 0xE9;
  41. *( DWORD * )( jmp + 1 ) = ( DWORD )( src + len - jmp ) - 5;
  42.  
  43. src[0] = 0xE9;
  44. *( DWORD * )( src + 1 ) = ( DWORD )( dst - src ) - 5;
  45. for( INT i = 5; i < len; i++ )
  46. src[i] = 0x90;
  47. VirtualProtect( src, len, dwBack, &dwBack );
  48.  
  49. return ( jmp - len );
  50. }
  51.  
  52. BOOL bCompare( CONST BYTE *pData, CONST BYTE *bMask, CONST CHAR *szMask )
  53. {
  54. for( ; *szMask; ++szMask, ++pData, ++bMask )
  55. if( *szMask == 'x' && *pData != *bMask )
  56. return false;
  57.  
  58. return ( *szMask ) == NULL;
  59. }
  60.  
  61. DWORD FindPattern(DWORD dwAddress,DWORD dwLen,BYTE *bMask,char * szMask)
  62. {
  63. for( DWORD i = 0; i < dwLen; i++ )
  64. if( bCompare( ( BYTE * )( dwAddress + i ), bMask, szMask ) )
  65. return ( DWORD )( dwAddress + i );
  66.  
  67. return 0;
  68. }
  69.  
  70. DWORD WINAPI StartRoutine( LPVOID )
  71. {
  72. while( TRUE )
  73. {
  74. DWORD hD3D = ( DWORD )LoadLibrary( "d3d9.dll" );
  75.  
  76. if( !DIPD3D9 )
  77. {
  78. // Windows XP
  79. DIPD3D9 = FindPattern( hD3D,
  80. 0x128000,
  81. ( PBYTE )"\x8B\xFF\x55\x8B\xEC\x5D\xE9\x00\x00\x00\x00\xCC\xCC\xCC\xCC\xCC\x8B\xFF\x55\x8B\xEC\x51",
  82. "xxxxxxx????xxxxxxxxxxx" );
  83. if( DIPD3D9 )
  84. {
  85. retDIPD3D9 = DIPD3D9 + 0x6;
  86. DetourCreate( ( PBYTE )DIPD3D9, ( PBYTE )DIPMidfunction, 5 );
  87. }
  88. }
  89.  
  90. if( !DIPD3D9 )
  91. {
  92. // Windows 7
  93. DIPD3D9 = FindPattern( hD3D,
  94. 0x128000,
  95. ( PBYTE )"\xC3\x90\x90\x90\x90\x90\x8B\xFF\x55\x8B\xEC\x5D\xEB\x05\x90\x90\x90\x90\x90\x8B\xFF\x55\x8B\xEC\x6A\xFF",
  96. "xxxxxxxxxxxxxxxxxxxxxxxxxx" );
  97. if( DIPD3D9 )
  98. {
  99. retDIPD3D9 = ( DIPD3D9 + 0x6 ) + 0x6;
  100. DetourCreate( ( PBYTE )( DIPD3D9 + 0x6 ), ( PBYTE )DIPMidfunction, 5 );
  101. }
  102. }
  103. }
  104.  
  105. return 0;
  106. }
  107.  
  108. BOOL WINAPI DllMain( HMODULE hDll, DWORD dwReason, LPVOID lpReserved )
  109. {
  110. if( dwReason == DLL_PROCESS_ATTACH )
  111. {
  112. DisableThreadLibraryCalls( hDll );
  113. MessageBox( 0, "WE11ington", "HOOK DIP", 0 );
  114. CreateThread( 0, 0, (LPTHREAD_START_ROUTINE)StartRoutine, 0, 0, 0 );
  115. }
  116.  
  117. return TRUE;
  118. }
Advertisement
Add Comment
Please, Sign In to add comment