Clean punkbuster screenshots

[zero_tolerance]

By: Okidoki



Hi,

Here is a way for returning clean PB screenshots.

First we have to find the DirectDrawCreate call in pbcl.dll ( I used IDA Pro ), it should look like that:

PHP Code:

.text:1000C030                 mov     edx, [esp+560h+wndpl.rcNormalPosition.bottom]
.text:1000C034                 mov     ecx, [esp+560h+wndpl.rcNormalPosition.top]
.text:1000C038                 push    edi             ; pUnkOuter
.text:1000C039                 lea     eax, [esp+564h+lpDD]
.text:1000C03D                 push    eax             ; lplpDD
.text:1000C03E                 sub     edx, ecx
.text:1000C040                 push    edi             ; lpGUID
.text:1000C041                 mov     [ebp+1Eh], dx
.text:1000C045                 mov     [esp+56Ch+var_534], edi
.text:1000C049                 mov     [esp+56Ch+lpDD], edi
.text:1000C04D                 call    DirectDrawCreate 


Then scroll up to the begining of the function that calls DirectDrawCreate, and find from where its called from:

PHP Code:

.text:1000B920 ; int __stdcall sub_1000B920(int,int,__int16,__int16,int,char *hWnd,int) 


PHP Code:

.text:1000EDF2                 push    eax             ; hWnd
.text:1000EDF3                 push    ecx             ; int
.text:1000EDF4                 mov     ecx, [ebp+118h]
.text:1000EDFA                 push    esi             ; __int16
.text:1000EDFB                 push    edi             ; __int16
.text:1000EDFC                 push    ebx             ; int
.text:1000EDFD                 push    edx             ; int
.text:1000EDFE                 mov     [esp+0AB4h+var_A84], 0B0h
.text:1000EE06                 call    sub_1000B920 


Then scroll up to the beginning of the function:

PHP Code:

.text:1000E030 ; int __fastcall sub_1000E030(int,int,int,int,unsigned int) 


Now we can detour it:

PHP Code:

typedef int ( *PBScreenshotSetup_t )( int iArg1 , int iArg2, int iArg3, int iArg4, unsigned int uiArg5 );
PBScreenshotSetup_t pPBScreenshotSetup = 0;

int _PBScreenshotSetup( int iArg1 , int iArg2, int iArg3, int iArg4, unsigned int uiArg5 )
{
    int iReturn;

    return pPBScreenshotSetup( iArg1 , iArg2, iArg3, iArg4, uiArg5 );
}

void Hook( )
{
    DWORD dwPbclBase = ( DWORD )GetModuleHandle( "pbcl.dll" );

    pPBScreenshotSetup = ( PBScreenshotSetup_t )DetourFunction( ( BYTE * )( dwPbclBase + 0xE030 ), ( BYTE * )_PBScreenshotSetup, 6 );
} 


Now here is how to manage a clean screenshot using a modulo:

PHP Code:

bool bSafeScreen = true;

int _PBScreenshotSetup( int iArg1 , int iArg2, int iArg3, int iArg4, unsigned int uiArg5 )
{
    bSafeScreen = false;

    static int iRequest = 0;

    iRequest++;

    int iReturn;

    if( iRequest <= 1 )
        iReturn = 2;
    else
    {
        iReturn = 2;
        
        if( iRequest % 16 == 1 )
        {
            iReturn = pPBScreenshotSetup( iArg1 , iArg2, iArg3, iArg4, uiArg5 );

            bSafeScreen = true;

            iRequest = 0;
        }
    }

    return iReturn;
} 


Usage:

PHP Code:

if( bSafeScreen )
{
    // Apply your visual modifications
} 


You can pause the screenshot function less or more by changing the modulo value (16).

This code is 100% working for up to date FarCry 1.4 punkbuster client.

Thanks to Roverturbo for the "iReturn = 2;" idea

Regards.

[Hooch]

I'm new,
Can you help me on understanding this part.

PHP Code:

int _PBScreenshotSetup( int iArg1 , int iArg2, int iArg3, int iArg4, unsigned int uiArg5 ) 
{ 
    bSafeScreen = false; //Because screenshot is requested we set it to false

    static int iRequest = 0; //???

    iRequest++;  // Is this number of times that pb makes screenshot? or number of times server requests screenshot?

    int iReturn; 

    if( iRequest <= 1 ) //If requested first time?
        iReturn = 2; //Why 2?
    else 
    { 
        iReturn = 2; //Again, why 2?
         
        if( iRequest % 16 == 1 ) //Every 16th time do...
        { 
            iReturn = pPBScreenshotSetup( iArg1 , iArg2, iArg3, iArg4, uiArg5 ); //Allow pb to take screenshot

            bSafeScreen = true; //It is safe because we already sent clear ss?

            iRequest = 0; //Screenshot is made so we set it 0 requests
        } 
    } 

    return iReturn; 
} 


If I understand it good server requests screenshot from us.
But our function is ignoring first 16 requests.
So whe have time (16 requests) to hide our hack.
And then after that time 16 requests we allow pb to make screenshot.

What happens if we ignore all requests?
why we are returning 2 if we ignore ss request?

Thanks for any help.