Direct3D9 Interface Hooking

[Anddos]

how would i use

Returned_Device_Interface->SetRenderState(D3DRS_FILLMODE, D3DFILL_WIREFRAME);

LPDIRECT3DDEVICE9* Returned_Device_Interface , i see this is a double pointer so i dont know how to use the device...

[Krtek]

Originally Posted by Anddos

how would i use

Returned_Device_Interface->SetRenderState(D3DRS_FILLMODE, D3DFILL_WIREFRAME);

LPDIRECT3DDEVICE9* Returned_Device_Interface , i see this is a double pointer so i dont know how to use the device...

Did you even try it out?

[Anddos]

yes i did

[I<3UC]

Thank you, I will try these when I find some time.

[ragehacker]

Thanks for this

+1

Helped me alot

[Th3Doc7or]

I can't say how grateful I am for this source. This kind of learning material is exactly what I need.

Great Job and Thanks!

[helicopter12]

Does this work for BattleField Bad Company 2?

[4bply]

This should work for any game that runs DX9

[DownDownDown]

Thanks for this great stuff roverturbo.

For me crash on WarRock.

Warrock doesn't start...

Any ideas?

[botex]

Originally Posted by DownDownDown

Thanks for this great stuff roverturbo.

For me crash on WarRock.

Warrock doesn't start...

Any ideas?

Probably Warrock's anti-cheat detect's it and it doesnt allow you to start your game with it.You will need to find another hooking method wich is undetced or bypass anti-cheat's scan.

[disavow]

Originally Posted by DownDownDown

Thanks for this great stuff roverturbo.

For me crash on WarRock.

Warrock doesn't start...

Any ideas?

WR just drops the createdevice so you can't hook it, not this way anyways.

[DownDownDown]

Uff i dont know really how hook the dip on warrock without rehooking =(

[botex]

Originally Posted by DownDownDown

Uff i dont know really how hook the dip on warrock without rehooking =(

This
http://www.uc-forum.com/forum/d3d-programming/65069-midfunction-hook.html

[DownDownDown]

It crash for me but this time isn't the HackShield but is warrock.. it do only black screen and after crash...

[botex]

Originally Posted by DownDownDown

It crash for me but this time isn't the HackShield but is warrock.. it do only black screen and after crash...

Then problem is with your hook.Try to do some log's to see where it crashes.

[DownDownDown]

It say allright.. :

Loading D3D9Dll -> OK!
Detouring EndScene -> OK!
All OK Starting WarRock
...
Crash! :S:S:S:S

[botex]

Originally Posted by DownDownDown

It say allright.. :

Loading D3D9Dll -> OK!
Detouring EndScene -> OK!
All OK Starting WarRock
...
Crash! :S:S:S:S

Do you use normal detours(1.5)? You can also attach debuger(Olly) to see where does it crash.Maybe you did not define your function like they should be.

[DownDownDown]

void *DetourCreate (BYTE *src, const BYTE *dst, const int len)
{
    BYTE *jmp;
    DWORD dwback;
    DWORD jumpto, newjump;
 
    VirtualProtect(src,len,PAGE_READWRITE,&dwback);
 
    if(src[0] == 0xE9)
    {
        jmp = (BYTE*)malloc(10);
        jumpto = (*(DWORD*)(src+1))+((DWORD)src)+5;
        newjump = (jumpto-(DWORD)(jmp+5));
        jmp[0] = 0xE9;
        *(DWORD*)(jmp+1) = newjump;
        jmp += 5;
        jmp[0] = 0xE9;
        *(DWORD*)(jmp+1) = (DWORD)(src-jmp);
    }
    else
    {
        jmp = (BYTE*)malloc(5+len);
        memcpy(jmp,src,len);
        jmp += len;
        jmp[0] = 0xE9;
        *(DWORD*)(jmp+1) = (DWORD)(src+len-jmp)-5;
    }
    src[0] = 0xE9;
    *(DWORD*)(src+1) = (DWORD)(dst - src) - 5;
 
    for(int i = 5; i < len; i++)
        src[i] = 0x90;
    VirtualProtect(src,len,dwback,&dwback);
    return (jmp-len);
}

I use this detour.

[botex]

Originally Posted by DownDownDown

I use this detour.

Use normal detours 1.5.If your game will still crash,try commenting out part's of your code and from there you will be able to see where/why does it crash.

[DownDownDown]

Yes i have tryed commenting some parts and at the moment of DetourCreate it crash.

I try the detours 1.5 thanks for help.

[Auto Merged - 0:34:46 Europe/Moscow]

Edit: Thanks with this detours warrock is opened but when load news it say Warrock crash etc IT ISN'T THE HACKSHIELD!

ALL MY SOURCE CODE:

#include <windows.h>
#include <d3d9.h>
#include <d3dx9.h>

#include "detours.h"

#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "d3dx9.lib")


DWORD * VTable;
DWORD dwEndscene_hook, dwEndscene_ret;
BYTE EndSceneOpCodes[6];

LPDIRECT3DDEVICE9 m_pD3Ddev; 
__declspec(naked) void MyEndscene( )
{
    __asm
    {
        mov dword ptr ss:[ebp - 10], esp;
        mov esi, dword ptr ss:[ebp + 0x8]; 
        mov m_pD3Ddev, esi; 
    }


    __asm
    {
        jmp dwEndscene_ret;
    }

}
bool bCompare(const BYTE* pData, const BYTE* bMask, const char* szMask)
{
    for(;*szMask;++szMask,++pData,++bMask)
        if(*szMask=='x' && *pData!=*bMask)   return 0;
    return (*szMask) == NULL;
}

DWORD FindPattern(DWORD dwdwAdd,DWORD dwLen,BYTE *bMask,char * szMask)
{
    for(DWORD i=0; i<dwLen; i++)
        if (bCompare((BYTE*)(dwdwAdd+i),bMask,szMask))  return (DWORD)(dwdwAdd+i);
    return 0;
}

void Dx9Hook( LPCSTR D3D9 )
{
    DWORD hD3D = NULL;
    while (!hD3D) hD3D = (DWORD)GetModuleHandleA(D3D9);
    DWORD PPPDevice = FindPattern(hD3D, 0x128000, (PBYTE)"\xC7\x06\x00\x00\x00\x00\x89\x86\x00\x00\x00\x00\x89\x86", "xx????xx????xx");
    memcpy( &VTable, (void *)(PPPDevice + 2), 4);

    dwEndscene_hook = VTable[42] + 0x2A; //mid function
    dwEndscene_ret = dwEndscene_hook + 0x6; //return address
}


void Thread(void)
{
Dx9Hook("d3d9.dll");


memcpy((void *)EndSceneOpCodes, (void *)"\x89\x65\xF0\x8B\x75\x08", 6);
       
while( 1 )
{
    Sleep( 1000 );

    if(memcmp((void *)EndSceneOpCodes, (void *)dwEndscene_hook, 6) == 0 )
       DetourFunction((PBYTE)dwEndscene_hook, (PBYTE)MyEndscene);


}

}



BOOL WINAPI DllMain( HMODULE hDll, DWORD Reason, PVOID lpReserved )
{
    if( Reason == DLL_PROCESS_ATTACH )
    {
        CreateThread( NULL, NULL, ( LPTHREAD_START_ROUTINE )&Thread, NULL, NULL, NULL );
    }
    return TRUE;
}