IAT hook D3D透视源码过检测的写法

文章转载来源：http://www.moguizuofang.com/bbs/thread-31432-1-1.html

原创公布了 hook方法,但没使用方法, 主流射击游戏通用,此代码仅供学习研究,游戏公司尽早修复漏洞


#include "stdafx.h"
#include <d3d9.h>
#include <d3dx9.h>
#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "d3dx9.lib")
bool bCompare(CONST BYTE *pData, CONST BYTE *bMask, CONST CHAR *szMask)
{for (; *szMask; ++szMask, ++pData, ++bMask)if (*szMask == 'x' && *pData != *bMask)return false;return (*szMask) == NULL;
}
DWORD FindPattern(DWORD dwAddress, DWORD dwLen, BYTE* bMask, char* szMask)
{for (DWORD i = 0; i < dwLen; i++)if (bCompare((BYTE *)(dwAddress + i), bMask, szMask))return (DWORD)(dwAddress + i);return 0;
}void __cdecl nReset(void)
{_asm pushad_asm popad
}
static DWORD PresentRetAddr;
__declspec(naked) DWORD __stdcall Present_Return(LPDIRECT3DDEVICE9 pDevice, CONST RECT *pSourceRect, CONST RECT *pDestRect, HWND hDestWindowOverride, CONST RGNDATA *pDirtyRegion)
{__asm{MOV EDI, EDIPUSH EBPMOV EBP, ESPjmp PresentRetAddr}}static LPDIRECT3DDEVICE9 pDevice;
LPD3DXFONT pFont = 0;
#define TextRed     D3DCOLOR_ARGB(255,255,0,0)
void WriteText(LPD3DXFONT g_pFont, INT x, INT y, D3DCOLOR Color, WCHAR *String)
{RECT Rect;SetRect(&Rect, x, y, x, y);g_pFont->DrawText(0, String, -1, &Rect, DT_LEFT | DT_NOCLIP, Color);
}//这个函数用于取当前的指针,或许有更好的办法......
HRESULT WINAPI Present_Detour(LPDIRECT3DDEVICE9 Device, CONST RECT *pSourceRect, CONST RECT *pDestRect, HWND hDestWindowOverride, CONST RGNDATA *pDirtyRegion)
{pDevice = Device; //这行代码执行后就可以恢复这个函数的钩子, 避免被检测//恢复的代码就自己写吧return Present_Return(Device, pSourceRect, pDestRect, hDestWindowOverride, pDirtyRegion);}D3DVIEWPORT9 VPort;
DWORD SCenterX, SCenterY;
WCHAR Msg[256];
void __cdecl nEndScene(void)
{static LPDIRECT3DDEVICE9 dwpDevice;static DWORD dwEBP=0,offset=0;__asm pushad__asm MOV dwEBP, EBPif (pDevice&&!offset){//遍历堆栈,取设备当前设备指针for (int i = 0; i < 1024; i++){if (*(DWORD*)(dwEBP + i) == (DWORD)pDevice){offset = i;break;}}}dwpDevice = *(LPDIRECT3DDEVICE9*)(dwEBP + offset);//取出指针if (offset&&dwpDevice){//这个判断防止空指针,避免崩溃/*以下就可以进行菜单绘制等操作*/static bool dwIPfos = 0;if (pFont){pFont->Release();pFont = NULL;dwIPfos = false;}if (!dwIPfos){D3DXCreateFont(pDevice, 15, 0, 800, 1, 0, DEFAULT_CHARSET, OUT_DEFAULT_PRECIS, ANTIALIASED_QUALITY, DEFAULT_PITCH | FF_DONTCARE, L"Arial", &pFont);dwIPfos = true;}WriteText(pFont, 150, 150, TextRed, L"德玛西亚");dwpDevice->GetViewport(&VPort);SCenterX = (float)VPort.Width / 2;SCenterY = (float)VPort.Height / 2;D3DRECT rec01 = { SCenterX - 2, SCenterY, SCenterX + 3, SCenterY + 1 };D3DRECT rec02 = { SCenterX, SCenterY - 2, SCenterX + 1, SCenterY + 3 };dwpDevice->Clear(1, &rec01, D3DCLEAR_TARGET, TextRed, 0, 0);dwpDevice->Clear(1, &rec02, D3DCLEAR_TARGET, TextRed, 0, 0);}__asm popad
}void __cdecl nDrawIndexedPrimitive(void)
{static LPDIRECT3DDEVICE9 dwpDevice;static DWORD dwEBP = 0, offset = 0;__asm pushad__asm MOV dwEBP, EBPif (pDevice&&!offset){for (int i = 0; i < 1024; i++){//遍历堆栈,取设备当前设备指针if (*(DWORD*)(dwEBP + i) == (DWORD)pDevice){offset = i;break;//取到就跳出}}}dwpDevice = *(LPDIRECT3DDEVICE9*)(dwEBP + offset);//取出指针if (offset&&dwpDevice){//这个判断防止空指针,避免崩溃LPDIRECT3DVERTEXBUFFER9   Stream = NULL;UINT Offset = 0;UINT Stride = 0;if (dwpDevice->GetStreamSource(0, &Stream, &Offset, &Stride) == D3D_OK)Stream->Release();if (Stride == 44 || Stride == 40){pDevice->SetRenderState(D3DRS_ZENABLE, FALSE);}}_asm popad
}
static DWORD hHooking = NULL;
static DWORD hEndScene = NULL;
static DWORD hReset = NULL;
static DWORD hDrawIndexPrimtive = NULL;typedef void (WINAPI * EnterCriticalSection_t) (LPCRITICAL_SECTION lpCriticalSection);
EnterCriticalSection_t  pEnterCriticalSection;void WINAPI nEnterCriticalSection(LPCRITICAL_SECTION lpCriticalSection)
{_asm{MOV EAX, [EBP + 0x4]MOV hHooking, EAX}// EndSceneif (hHooking == hEndScene){__asm call[nEndScene]}//Resetif (hHooking == hReset){__asm call[nReset]}// DIPif (hHooking == hDrawIndexPrimtive){__asm call[nDrawIndexedPrimitive];}return pEnterCriticalSection(lpCriticalSection);
}
void* DetourCreate(BYTE *src, CONST BYTE *dst, CONST INT len)
{BYTE *jmp = (BYTE*)malloc(len + 5);DWORD dwback;VirtualProtect(src, len, PAGE_READWRITE, &dwback);memcpy(jmp, src, len); jmp += len;jmp[0] = 0xE9;*(DWORD*)(jmp + 1) = (DWORD)(src + len - jmp) - 5;src[0] = 0xE9;*(DWORD*)(src + 1) = (DWORD)(dst - src) - 5;//VirtualProtect(src, len, dwback, &dwback);return (jmp - len);
}
void InitDevice(void)
{LPDIRECT3D9 pD3d9 = NULL;DWORD oldflag;LPDIRECT3DDEVICE9 pD3DDevice = NULL;pD3d9 = Direct3DCreate9(D3D_SDK_VERSION);if (pD3d9 == NULL){MessageBox(NULL, L"[ERROR] Direct3DCreate9 失败", L" Error", MB_ICONERROR | MB_ICONSTOP);return;}D3DPRESENT_PARAMETERS pPresentParms;ZeroMemory(&pPresentParms, sizeof(pPresentParms));pPresentParms.Windowed = TRUE;pPresentParms.BackBufferFormat = D3DFMT_UNKNOWN;pPresentParms.SwapEffect = D3DSWAPEFFECT_DISCARD;if (FAILED(pD3d9->CreateDevice(D3DADAPTER_DEFAULT, D3DDEVTYPE_HAL, GetDesktopWindow(), D3DCREATE_SOFTWARE_VERTEXPROCESSING, &pPresentParms, &pD3DDevice))){MessageBox(NULL, L"[ERROR] CreateDevice Failed", L"Fatal Error", MB_ICONERROR | MB_ICONSTOP);return;}DWORD * dwTable = (DWORD*)pD3DDevice;dwTable = (DWORD*)dwTable[0];PresentRetAddr = dwTable[17] + 5;DetourCreate((PBYTE)dwTable[17], (PBYTE)&Present_Detour, 5);}
void  WINAPI Start()
{//DWORD hD3D, hCriticalSection;do{hD3D = (DWORD)GetModuleHandle(L"d3d9.dll");Sleep(100);} while (!hD3D);hCriticalSection = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\x74\x07\x00\xFF\x15\x00\x00\x00\x00\x8D\x00\x00", "xx?xx????x??")+5;hCriticalSection =*(DWORD*)hCriticalSection;if (!hCriticalSection){MessageBox(NULL, L"Error Code (0)", L"Error", MB_ICONERROR);exit(1);}//if (!hReset)//  hReset = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\xFF\x15\x00\x00\x00\x00\x3B\x43\x20\x74\x1B\x8B\x46\x18\x85\xC0\x74\x07\x56", "xx????xxxxxxxxxxxxx");// Win XP//if (!hReset)hReset = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\x57\xFF\x15\x00\x00\x00\x00\x8B\x45\x0C\x33\xF6\x39\x70\x20", "xxx????xxxxxxxx")+7;// Vista - Win7if (!hReset)hReset = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\x33\xC9\x39\x4F\x20\x75\x79\x8D\x44\x24\x38\x89\x44\x24\x1C\x32\xC0\x8B\xDE", "xxxxxxxxxxxxxxxxxxx");// Win 8.0if (!hReset)hReset = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\x8B\xCE\xE8\x00\x00\x00\x00\x8B\x4E\x0C\x48\xF7\xD8", "xxx????xxxxxx");// Win 8.1 if (!hReset){MessageBox(NULL, L"Error Code (1)", L"Error", MB_ICONERROR);exit(1);}
//  MessageBox(0, L"This", 0, 0);//return;//if (!hEndScene)//hEndScene = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\x57\xFF\x15\x00\x00\x00\x00\xF6\x46\x00\x00\x89\x5D\xFC\x75\x0E\x8B\x86\x00\x00\x00\x00\xA8\x01\xC6\x45\x00\x00\x75\x24", "xxx????xx??xxxxxxx????xxxx??xx")+7; // Win XP//if (!hEndScene)hEndScene = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\x57\xFF\x15\x00\x00\x00\x00\xE9\x00\x00\x00\x00\x39\x5F\x18\x74\x07\x57\xFF\x15\x00\x00\x00\x00\xB8\x00\x00\x00\x00\x8B\x4D\xF4\x64\x89\x0D\x00\x00\x00\x00\x59\x5F\x5E\x5B\x8B\xE5\x5D\xC2\x04\x00\x68\xAD\x06\x00\x00", "xxx????x????xxxxxxxx????x????xxxxxx????xxxxxxxxxxxxx??")+7; // Vista Win7if (!hEndScene)hEndScene = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\x33\xC0\xE8\x00\x00\x00\x00\xC2\x04\x00\x8B\xDF\xEB\x8E\x53\xFF\x15\x00\x00\x00\x00\xEB\x90", "xxx????xxxxxxxxxx????xx")+21;// Win8 8.0 + 8.1                if (!hEndScene){MessageBox(NULL, L"Error Code (2)", L"Error", MB_ICONERROR);exit(1);}//if (!hDrawIndexPrimtive)//hDrawIndexPrimtive = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\x53\xFF\x15\x00\x00\x00\x00\xF6\x46\x00\x00\x89\x7D\xFC\x74\x24\x39\x7B\x18\x74\x07\x53\xFF\x15\x00\x00\x00\x00\xB8\x00\x00\x00\x00\x8B\x4D\xF4\x64\x89\x0D\x00\x00\x00\x00\x5F\x5E\x5B\x8B\xE5\x5D\xC2\x1C\x00", "xxx????xx??xxxxxxxxxxxxx????x????xxxxxx????xxxxxxxxx")+7;// Win XP//if (!hDrawIndexPrimtive)hDrawIndexPrimtive = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\x56\xFF\x15\x00\x00\x00\x00\xE9\x00\x00\x00\x00\x39\x5E\x18\x74\x07\x56\xFF\x15\x00\x00\x00\x00\xB8\x00\x00\x00\x00\x8B\x4D\xF4\x64\x89\x0D\x00\x00\x00\x00\x59\x5F\x5E\x5B\x8B\xE5\x5D\xC2\x1C\x00\x39\x9E\x00\x00\x00\x00", "xxx????x????xxxxxxxx????x????xxxxxx????xxxxxxxxxxxx????")+7;// Vista - Win7if (!hDrawIndexPrimtive)hDrawIndexPrimtive = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\xE9\x00\x00\x00\x00\x00\xFF\x00\x00\x00\x00\x00\xE9\x00\x00\x00\x00\xC7\x45\x00\x00\x00\x00\x00\x8D\x4D\x00\xE8\x00\x00\x00\x00\xB8\x00\x00\x00\x00\xE9\x00\x00\x00\x00\x83\xBA\x00\x00\x00\x00\x00\x74\x00", "x?????x?????x????xx?????xx?x????x????x????xx?????x?")+12; // Win8 8.0 + 8.1if (!hDrawIndexPrimtive){MessageBox(NULL, L"Error Code (3)", L"Error", MB_ICONERROR);exit(1);}if (hReset && hEndScene && hDrawIndexPrimtive){DWORD dwBack;VirtualProtect((void*)(hCriticalSection), 4, PAGE_EXECUTE_READWRITE, &dwBack);pEnterCriticalSection = (EnterCriticalSection_t)*(DWORD*)(hCriticalSection);*(DWORD*)(hCriticalSection) = (DWORD)nEnterCriticalSection;VirtualProtect((void*)(hCriticalSection), 4, dwBack, &dwBack);InitDevice();return ;}return ;
}
BOOL WINAPI DllMain(HMODULE hDll, DWORD dwReason, LPVOID lpReserved)
{if (dwReason == DLL_PROCESS_ATTACH){CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)Start, NULL, NULL, NULL);}return TRUE;
}

IAT hook D3D透视源码过检测的写法相关推荐

FPS游戏透视源码!
FPS游戏透视源码! 2011年10月03日需要的自己拿 ,部分插件需要自己给路径!~你懂的 C语言编译环境哈!#include #include #pragma comment(lib, &quo ...
短视频系统源码，检测在手机上的触摸按下、拖拽、抬手
短视频系统源码,检测在手机上的触摸按下.拖拽.抬手 var touch_pos = Vector2.ZERO # 触摸位置 var lift_up_pos = Vector2.ZERO # 抬手位置 ...
论文阅读笔记——基于CNN-GAP可解释性模型的软件源码漏洞检测方法
本论文相关内容论文下载地址--Engineering Village 论文阅读笔记--基于CNN-GAP可解释性模型的软件源码漏洞检测方法文章目录本论文相关内容前言基于CNN-GAP可解释性 ...
直播视频网站源码，SharedPreference简便写法
直播视频网站源码,SharedPreference简便写法实现的相关代码写法1: val sp = ConstantsConfig.getContext().getSharedPreferences ...
DynaSLAM源码笔记-检测动态物体部分梳理
按照main函数向下细分的顺序大概记录一下rgbd情况下,动态物体去除(inpaint的部分本篇不涉及)的源码的写法,并对应一下论文, 关于ORB-SLAM2本身的部分不会太涉及到. 安装方法见:关于 ...
php源码安全检测,微信域名拦截安全检测API PHP源码
微信域名安全检测API PHP源码感谢蓝优提供源码这是一个很简单操作,利用跳转检测是否和域名一致. 调用:域名/api.php?url= /** ------------------------- ...
Android项目源码质量检测
摘要:通过工具对Android项目源码进行质量检测从开发的角度来讲,一款软件的优秀与否,除了与软件整体架构有关,还决定于开发者的编码是否规范以及能否对相关平台特性的充分利用.对于软件的整体架构,目前 ...
cs透视源码c语言,[原始] CS1.6透视插件（非D3D Hook）的简单分析（包括透视源代码）...
Cs1.6透视图插件,进行反向操作,编写OpenGL32透视图cs1.6人物透视指令,并与所有人共享今天的成功. . 实际上,它也非常简单,代码很少,所需的工具为cs1.6,ollydebug,vs2 ...
React源码解毒 - 检测开发者是否错误的使用了props属性
说明: 在使用react.createElement()创建react 元素的时候,如果是开发环境中,错误地使用了props属性对key属性或者ref属性进行了访问,会在控制台中提示相应的错误. // ...

IAT hook D3D透视源码过检测的写法

IAT hook D3D透视源码过检测的写法相关推荐

最新文章

热门文章

IAT hook D3D透视源码 过检测的写法

IAT hook D3D透视源码 过检测的写法相关推荐

最新文章

热门文章

IAT hook D3D透视源码过检测的写法

IAT hook D3D透视源码过检测的写法相关推荐