Welcome to the UnKnoWnCheaTs - Multiplayer Game Hacks and Cheats.
You have to register before you can post and see and access any of the advanced forum features, please click the register link to proceed to the registration form. To start viewing threads or posts, select a forum that you want to visit from the selection below.
Direct3D hacking programming reversing
You are Unregistered, please register to gain Full access.
Endscene
This time device is already been loaded and checked for null device
Code:
__declspec(naked) void MyEndscene( )
{
__asm
{
//most registers have already been preserved
pushaf; //we are in the middle of a conditional jmp
mov dword ptr ss:[ebp-1C], edi;
mov dword ptr ss:[ebp-18], ebx; //replace patched code
mov m_pD3Ddev, esi; //Get the device (loaded previously)
}
__asm
{
popaf; //je is set
jmp dwEndscene_ret;//jump back to normal endscene
}
}
My offset init function using vtable pattern that Gordon' posted
I think the proper way to preserve the flags/registers what ever YOU call them would be.
Code:
_declspec(naked) void MyEndscene( )
{
__asm
{
mov dword ptr ss:[ebp-1C], edi;
mov dword ptr ss:[ebp-18], ebx;
mov m_pD3Ddev, esi;
pushaf;
}
__asm
{
popaf; //je is set
jmp dwEndscene_ret;//jump back to normal endscene
}
}
Personally i would use pushad/popad as well
I'm preserving the flags before this: mov dword ptr ss:[ebp-1C], edi;
because a flags have been set by the cmp op before it, not that it matters.
As I said all the registers have already been preserved and doing so again would probably crash it...
They wouldn't need to be preserved anyways, since they get reset after this hook.
Right thx little,similar of what i'm doing with the OS check for the addies of op7
or you could create a "emtpy" function, getting the current bytes and writing them into it so you would not need 2 caves and you will not need a os check : )
or you could create a "emtpy" function, getting the current bytes and writing them into it so you would not need 2 caves and you will not need a os check : )
I've seen this approach work with punkbuster in the past, I am not sure if it was JoshRose or R4z8r who spoke to me about it, they may have also released source-code somewhere on this forum...
Punkbuster would only scan the first 5-10 bytes of directx functions, so you can hook deeper within the function or hook subfunctions, etc. I am not sure if this is still the case however.
I've seen this approach work with punkbuster in the past, I am not sure if it was JoshRose or R4z8r who spoke to me about it, they may have also released source-code somewhere on this forum...
Punkbuster would only scan the first 5-10 bytes of directx functions, so you can hook deeper within the function or hook subfunctions, etc. I am not sure if this is still the case however.
As far as i'm aware it still works with punkbuster also.
Prehaps all anti detections tools except the latest version of gameguard.
SubFunctions work but that can go into a different sort of territory.
Once you go through there actual function calls and conditional jumps, there is much more that can be modified within the function without triggering a scan.
Once people learn a basic midfunction technique like this I guess they can be more creative and look into these options.
