#include <Windows.h>
#include <stdio.h>
#include <conio.h>
#include <d3d9.h>
#include <d3dx9.h>
#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "d3dx9.lib")
#define PI 3.141
#define Yellow D3DCOLOR_ARGB( 255, 255, 255, 000 )
typedef HRESULT ( WINAPI * DrawIPrim )( LPDIRECT3DDEVICE9, D3DPRIMITIVETYPE, INT, UINT, UINT, UINT, UINT );
VOID Jump( DWORD Address, DWORD Your_Detour );
DWORD Old = NULL;
LPDIRECT3DDEVICE9 pDev;
LPDIRECT3D9 pD3D;
D3DVIEWPORT9 Viewport;
DrawIPrim pDrawIPrim = NULL;
DWORD dwEndscene_hook = NULL;
DWORD dwEndscene_ret = NULL;
DWORD dwDIP_hook = NULL;
DWORD dwDIP_ret = NULL;
DWORD dwReset_hook = NULL;
DWORD dwReset_ret = NULL;
DWORD bJump = NULL;
LPD3DXFONT pFont=NULL;
LPD3DXLINE pLine=NULL;
HMODULE D3D9 = NULL;
VOID RenderString(LPDIRECT3DDEVICE9 pDev, int x, int y, DWORD color, LPD3DXFONT g_pFont, const char *fmt, ...)
{
if( !pFont )
D3DXCreateFontA( pDev,13,0,FW_BOLD,1,0,DEFAULT_CHARSET,OUT_DEFAULT_PRECIS,DEFAULT_QUALITY,DEFAULT_PITCH | FF_DONTCARE,"Arial", &pFont );
if(!g_pFont)
return;
RECT FontPos = { x, y, x + 50, y + 50};
char buf[1024] = {'\0'};
va_list va_alist;
va_start(va_alist, fmt);
vsprintf_s(buf, fmt, va_alist);
va_end(va_alist);
pDev->SetRenderState( D3DRS_ZENABLE,false );
pDev->SetRenderState( D3DRS_FILLMODE,D3DFILL_SOLID );
g_pFont->DrawTextA(NULL, buf, -1, &FontPos, DT_NOCLIP, color);
pDev->SetRenderState( D3DRS_ZENABLE, true );
pDev->SetRenderState( D3DRS_FILLMODE,D3DFILL_SOLID );
}
VOID FillRGB(LPDIRECT3DDEVICE9 pDev,int x, int y, int w, int h, DWORD color )
{
D3DRECT rec = { x, y, x + w, y + h };
pDev->Clear( 1, &rec, D3DCLEAR_TARGET, color, 0, 0 );
}
VOID RenderBox(LPDIRECT3DDEVICE9 pDev, int x, int y, int w, int h, int px, DWORD color, DWORD color2)
{
//box
FillRGB(pDev, x, y, w, h, color);
//border
FillRGB(pDev, x, (y + h - px), w, px,color2);
FillRGB(pDev, x, y, px, h,color2 );
FillRGB(pDev, x, y, w, px,color2);
FillRGB(pDev, (x + w - px), y, px, h,color2);
}
VOID RenderCircle(LPDIRECT3DDEVICE9 pDev,int X, int Y, int radius, int numSides, DWORD Color)
{
if (!pLine)
D3DXCreateLine(pDev, &pLine);
D3DXVECTOR2 Line[128];
float Step = (float)(PI * 2.0 / numSides);
int Count = 0;
for (float a=0; a < PI*2.0; a += Step)
{
float X1 = radius * cos(a) + X;
float Y1 = radius * sin(a) + Y;
float X2 = radius * cos(a+Step) + X;
float Y2 = radius * sin(a+Step) + Y;
Line[Count].x = X1;
Line[Count].y = Y1;
Line[Count+1].x = X2;
Line[Count+1].y = Y2;
Count += 2;
}
pLine->Begin();
pLine->Draw(Line,Count,Color);
pLine->End();
pLine->Release();
}
VOID RenderCross(LPDIRECT3DDEVICE9 pDev, DWORD color, int i)
{
pDev->GetViewport( &Viewport );
DWORD ScreenCenterX = (Viewport.Width / 2);
DWORD ScreenCenterY = (Viewport.Height / 2);
D3DRECT rec1 = {ScreenCenterX-i, ScreenCenterY, ScreenCenterX+ i, ScreenCenterY+1};
D3DRECT rec2 = {ScreenCenterX, ScreenCenterY-i, ScreenCenterX+ 1,ScreenCenterY+i};
pDev->Clear( 1, &rec1, D3DCLEAR_TARGET, color, 0, 0 );
pDev->Clear( 1, &rec2, D3DCLEAR_TARGET, color, 0, 0 );
//RenderCircle(pDev, ScreenCenterX, ScreenCenterY, i+3,i+3, color);
}
bool IsMenuOn =false;
VOID WINAPI hkEndScene(LPDIRECT3DDEVICE9 pDev )
{
__asm nop
if((GetAsyncKeyState(VK_DELETE) & 0x1))
IsMenuOn = !IsMenuOn;
RenderString(pDev, 5, 5, Yellow, pFont, "[BugZ v1.0] Press Delete to turn Chams On/Off ");
if (IsMenuOn){
RenderCross(pDev, Yellow, 15);
}
}
__declspec(naked) void MyEndscene( )
{
__asm
{
MOV DWORD PTR SS:[EBP-0x10],ESP
MOV ESI,DWORD PTR SS:[EBP+0x8]
XOR EBX,EBX //replace patched code
PUSHFD
PUSHAD
PUSH [EBP+0x8]
CALL hkEndScene;
POPAD
POPFD
CMP ESI,EBX //replace patched code
jmp dwEndscene_ret; //jump back to normal endscene
}
}
VOID SetModelColor(LPDIRECT3DDEVICE9 pDev, float r, float g, float b, float a, float glowr, float glowg, float glowb, float glowa)
{
float lightValues[4] = {r, g, b, a};
float glowValues[4] = {glowr, glowg, glowb, glowa};
pDev->SetPixelShaderConstantF(1, lightValues, 1);
pDev->SetPixelShaderConstantF(3, glowValues, 1);
}
VOID WINAPI hkDrawIndexedPrimitive(LPDIRECT3DDEVICE9 pDev, D3DPRIMITIVETYPE Type, INT BIndex, UINT MIndex, UINT NVertices, UINT SIndex, UINT PCount )
{
bJump = TRUE;
LPDIRECT3DVERTEXBUFFER9 Stream_Data;
UINT Offset = 0;
UINT Stride = 0;
if( pDev->GetStreamSource( 0, &Stream_Data, &Offset, &Stride ) == S_OK )Stream_Data->Release();
if (IsMenuOn)
{
// Disable fog
pDev->SetRenderState(D3DRS_FOGENABLE, false);
// Fullbright
pDev->SetRenderState(D3DRS_LIGHTING, FALSE);
pDev->SetRenderState(D3DRS_AMBIENT,D3DCOLOR_ARGB(255,255,255,255));
switch (Stride)
{
case 20: // Buildings
//pDev->SetRenderState(D3DRS_ALPHABLENDENABLE,TRUE);
pDev->SetRenderState(D3DRS_DESTBLEND,D3DBLEND_INVSRCALPHA); // Transparency
break;
case 32: // Players and Zombies
//PlayerChams
pDev->SetRenderState(D3DRS_LIGHTING, FALSE); // Wallhack
pDev->SetRenderState(D3DRS_ZENABLE, FALSE);
SetModelColor(pDev, 1.0f, 0.0f, 0.0f, 0.50f, 1.5f, 1.5f, 1.5f, 1.5f);
pDrawIPrim( pDev, Type, BIndex, MIndex, NVertices, SIndex, PCount );
pDev->SetRenderState(D3DRS_ZENABLE, TRUE);
break;
default:
break;
}
}
bJump = FALSE;
}
__declspec(naked) void MyDIP( )
{
__asm
{
MOV EDI,DWORD PTR SS:[EBP+0x8]
XOR EBX,EBX
CMP EDI,EBX // replace patched code
PUSHFD
PUSHAD
MOV EDX,[bJump]
CMP EDX,0x0
JG DONE
PUSH [EBP+0x20] // Push arguments of DIP
PUSH [EBP+0x1C]
PUSH [EBP+0x18]
PUSH [EBP+0x14]
PUSH [EBP+0x10]
PUSH [EBP+0x0C]
PUSH [EBP+0x08]
CALL hkDrawIndexedPrimitive
DONE: POPAD
POPFD
jmp dwDIP_ret; // jump back to normal DIP
}
}
VOID WINAPI hkReset( )
{
if( pFont != NULL )
if( pFont->Release( ) == S_OK )
pFont = NULL;
}
__declspec(naked) void MyReset( )
{
__asm
{
PUSHAD
PUSHFD
CALL hkReset
POPFD
POPAD
MOV ESI,DWORD PTR SS:[EBP-0x08]
MOV EDI,DWORD PTR SS:[EBP-0x04]
POP EBX
JMP dwReset_ret
}
}
VOID WINAPI GETD3D( VOID )
{
HWND ConsoleWindow = GetConsoleWindow( );
ShowWindow( ConsoleWindow, SW_HIDE ); // hide ConsoleWindow...
while( D3D9 == NULL )
{
D3D9 = GetModuleHandleA( "d3d9.dll" );
Sleep( 100 );
}
D3DPRESENT_PARAMETERS D3D_PP = {0};
IDirect3D9 * (WINAPI *oDirect3DCreate9)(UINT SDKVersion);
*(PDWORD)&oDirect3DCreate9 = (DWORD)GetProcAddress( D3D9, "Direct3DCreate9" );
_cprintf( "Direct3DCreate9\n" );
pD3D = oDirect3DCreate9( D3D_SDK_VERSION );
D3D_PP.Windowed = TRUE;
D3D_PP.SwapEffect = D3DSWAPEFFECT_DISCARD;
D3D_PP.BackBufferFormat = D3DFMT_UNKNOWN;
_cprintf( "CreateDevice\n" );
pD3D->CreateDevice( D3DADAPTER_DEFAULT, D3DDEVTYPE_HAL,ConsoleWindow, D3DCREATE_SOFTWARE_VERTEXPROCESSING, &D3D_PP, &pDev );
PDWORD VTABLE = *(DWORD**)pDev;
dwEndscene_hook = VTABLE[42] + 0x2A;
dwEndscene_ret = dwEndscene_hook + 0x0A;
dwDIP_hook = VTABLE[82] + 0x2D;
dwDIP_ret = dwDIP_hook + 0x7;
dwReset_hook = VTABLE[16] + 165;
dwReset_ret = dwReset_hook + 0x7;
*(PDWORD)&pDrawIPrim = (DWORD)VTABLE[82];
_cprintf( "Jump\n" );
Jump( (DWORD)dwEndscene_hook, (DWORD)MyEndscene );
Jump( (DWORD)dwDIP_hook, (DWORD)MyDIP );
Jump( (DWORD)dwReset_hook, (DWORD)MyReset );
_cprintf( "Done\n" );
Sleep( 400 );
pDev->Release( );
pD3D->Release( );
FreeConsole( );
}
VOID Jump( DWORD Address, DWORD Your_Detour )
{
VirtualProtect( (LPVOID)Address, 5, PAGE_EXECUTE_READWRITE, &Old );
*(PBYTE)Address = (BYTE)0xE9;
*(PDWORD)(Address + 1) = ( Your_Detour - Address - 5) ;
VirtualProtect( (LPVOID)Address, 5, Old, &Old );
}
BOOL WINAPI DllMain( HINSTANCE hModule, DWORD dwReason, LPVOID lpvReserved )
{
if( dwReason == DLL_PROCESS_ATTACH )
{
DisableThreadLibraryCalls( hModule );
AllocConsole( );
_cprintf( "Ready\n" );
CreateThread( NULL, NULL, (LPTHREAD_START_ROUTINE)
GETD3D, NULL, NULL, NULL);
}
return TRUE;
}
Deutsch