| View previous topic :: View next topic |
| Author |
Message |
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
 Posted: Tue Oct 14, 2008 5:12 pm Post subject: |
 |
|
Hmmm... All I have done so far is get the pointer returned by Direct3DCreate8....
So I Have to create a new device and write stuff there using this interface or do I need the device too? I dont do direct3d... I have done directdraw before.
|
|
| Back to top |
|
 |
Flyte
Peanuts!!!!
 Reputation: 6
Joined: 19 Apr 2006
Posts: 1887
Location: Canada
|
| Posted: Tue Oct 14, 2008 6:42 pm Post subject: |
|
|
You pass a proxy class as the return to the function.
@smartz993: It isn't like this is an original idea anyways. I made one a while ago for MS and nForce did one for FlyFF with AntTweakBar.
@KiKi: As I said above, inject the dx8 compatible version of CEGui. A lot easier... or you could just spend quite a few lines of code messing with your own GUI with DirectInput.
Bye.
|
|
| Back to top |
|
|
GMZorita
Grandmaster Cheater Supreme
![]() Reputation: 0
Joined: 21 Mar 2007
Posts: 1361
|
| Posted: Tue Oct 14, 2008 8:00 pm Post subject: |
|
|
| Flyte wrote: | You pass a proxy class as the return to the function.
@smartz993: It isn't like this is an original idea anyways. I made one a while ago for MS and nForce did one for FlyFF with AntTweakBar.
@KiKi: As I said above, inject the dx8 compatible version of CEGui. A lot easier... or you could just spend quite a few lines of code messing with your own GUI with DirectInput.
Bye. |
And there go the 1337 posts...
OnTopic:
nvm not telling my method.
_________________
Gone
Last edited by GMZorita on Wed Oct 15, 2008 7:29 am; edited 1 time in total |
|
| Back to top |
|
|
smartz993
I post too much
 Reputation: 2
Joined: 20 Jun 2006
Posts: 2013
Location: USA
|
| Posted: Tue Oct 14, 2008 8:36 pm Post subject: |
|
|
| GMZorita wrote: | | Flyte wrote: | You pass a proxy class as the return to the function.
@smartz993: It isn't like this is an original idea anyways. I made one a while ago for MS and nForce did one for FlyFF with AntTweakBar.
@KiKi: As I said above, inject the dx8 compatible version of CEGui. A lot easier... or you could just spend quite a few lines of code messing with your own GUI with DirectInput.
Bye. |
And there go the 1337 posts...
OnTopic:
Its quite easy to hook it at MS w/o eiditing the memory in the crc range. |
Do you have any idea what the FUCK you're talking about?
|
|
| Back to top |
|
|
kittonkicker
I post too much
 Reputation: 1
Joined: 19 Apr 2006
Posts: 2171
|
| Posted: Wed Oct 15, 2008 10:43 am Post subject: |
|
|
Why are you guys always spamming/fighting. Just lock the thread already...
Thanks Flyte, I might take a look into that!
_________________
All gone  |
|
| Back to top |
|
|
smartz993
I post too much
Reputation: 2
Joined: 20 Jun 2006
Posts: 2013
Location: USA
|
| Posted: Wed Oct 15, 2008 12:40 pm Post subject: |
|
|
| kittonkicker wrote: | Why are you guys always spamming/fighting. Just lock the thread already...
Thanks Flyte, I might take a look into that! |
I looked at it..it looks like DB made a whole Direct-X interface for an aimbot hahaha.
|
|
| Back to top |
|
|
Flyte
Peanuts!!!!
Reputation: 6
Joined: 19 Apr 2006
Posts: 1887
Location: Canada
|
| Posted: Wed Oct 15, 2008 11:32 pm Post subject: |
|
|
| smartz993 wrote: | | kittonkicker wrote: | Why are you guys always spamming/fighting. Just lock the thread already...
Thanks Flyte, I might take a look into that! |
I looked at it..it looks like DB made a whole Direct-X interface for an aimbot hahaha. |
Sorry, I had to come back to laugh at the blatant ignorance. Everything with the letters CE in the acronym could not possibly mean anything other than Cheat Engine could it? Just call it a feeling, but I believe it stands for something along the lines of Cra.. something Eddie. Oh that's right, Crazy Eddie...
Good day to you sir.
|
|
| Back to top |
|
|
tombana
Master Cheater
![]() Reputation: 2
Joined: 14 Jun 2007
Posts: 456
Location: The Netherlands
|
| Posted: Thu Oct 16, 2008 8:43 am Post subject: |
|
|
Instead of passing the proxy class back to the program, isn't it easier to pass back the original class, and just change the 'Present' member of it?
The 'handle' you pass back, points to a list of DWORDS, each being the address of a function. If you change the dword which holds the address of 'Present' to your own function, and save the original, you don't have to write a complete class and forwards all the functions. Or am I missing something here?
EDIT: Also, why don't you use 'EndScene' instead of 'Present' ? (You're supposed to do all the drawing before you call EndScene)
EDIT2:
I tried it myself and it worked.
I hook Direct3DCreate9. It's return value points to a list of function addresses. One of those is the address of CreateDevice. I save the real address and change it to one of my own functions. Then when the application calls CreateDevice, my function will call the original CreateDevice first. The IDirect3DDevice that is returned, is again a pointer to a list of addresses. I change the address of the 'EndScene' function to my own function and then I'm done.
The only weird thing is that when D3DXFont::DrawText is called, it will replace the address of 'EndScene' with the original. I have no clue why it does that, it doesn't make any sense. But apart from that, I think this would be the 'stealthiest' way to do it, with the least chance of detection.
|
|
| Back to top |
|
|
smartz993
I post too much
Reputation: 2
Joined: 20 Jun 2006
Posts: 2013
Location: USA
|
| Posted: Fri Oct 17, 2008 3:24 pm Post subject: |
|
|
| Flyte wrote: | | smartz993 wrote: | | kittonkicker wrote: | Why are you guys always spamming/fighting. Just lock the thread already...
Thanks Flyte, I might take a look into that! |
I looked at it..it looks like DB made a whole Direct-X interface for an aimbot hahaha. |
Sorry, I had to come back to laugh at the blatant ignorance. Everything with the letters CE in the acronym could not possibly mean anything other than Cheat Engine could it? Just call it a feeling, but I believe it stands for something along the lines of Cra.. something Eddie. Oh that's right, Crazy Eddie...
Good day to you sir. |
When you are browsing a site that's whole point is to support a program called Cheat Engine, otherwise known as CE, your first thought when you see the acronym should be Cheat Engine, no? And since Dark Byte's Cheat Engine does have a DirectXHook dll, i only assumed.
|
|
| Back to top |
|
|
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
| Posted: Fri Oct 17, 2008 4:41 pm Post subject: |
|
|
Hmm... Is it me or are the C++ directx classes different from the delphi ones? Cause maple is C++ and what I did was C++ using a clean class and it doesn't work? So Should I use C++ to do this?
This is what i have done:
| Code: | library DirectXOverlay;
uses
Windows, Messages, SysUtils, Variants, Classes, StdCtrls, ExtCtrls,psapi,winsvc,DirectXGraphics;
{$R *.res}
var
jumper:pbytearray;
dxHandle:Cardinal;
dxHook:Cardinal;
originalprotection:Cardinal;
function xhDirect3DCreate8(SDKVersion:DWORD):IDirect3D8;
var
hCb:DWORD;
begin
hCb:=Dword(GetProcAddress(dxHandle,'Direct3DCreate8'))+5;
asm
mov edi,edi
push ebp
mov ebp,esp
jmp [hCb]
end;
end;
function xDirect3DCreate8(SDKVersion:DWORD):IDirect3D8;
begin
Result:=xhDirect3DCreate8(SDKVersion);
end;
begin
dxHandle:=GetModuleHandle('d3d8.dll');
dxHook:=Dword(GetProcAddress(dxHandle,'Direct3DCreate8'))+5;
virtualprotect(pointer(dxHook),5,PAGE_EXECUTE_READWRITE,originalprotection);
//Hook Direct3DCreate8
jumper:=pointer(dxHook-5);
jumper[0]:=$E9;
pdword(@jumper[1])^:=dword(@xDirect3DCreate8)-dword(dword(@jumper[0])+$5);
end. |
IDirect3D8 Is a d3d class.
|
|
| Back to top |
|
|
tombana
Master Cheater
![]() Reputation: 2
Joined: 14 Jun 2007
Posts: 456
Location: The Netherlands
|
| Posted: Sat Oct 18, 2008 10:15 am Post subject: |
|
|
| Remeber that the Direct3D classes are COM classes. When you call it's functions, the last parameter pushed on the stack (so the first parameter you would write down) is the pointer to the interface itself. (the 'this' keyword in c++)
|
|
| Back to top |
|
|
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
| Posted: Sat Oct 18, 2008 10:59 am Post subject: |
|
|
| I dont get it O.o
|
|
| Back to top |
|
|
Zand
Master Cheater
![]() Reputation: 0
Joined: 21 Jul 2006
Posts: 424
|
| Posted: Sat Oct 18, 2008 12:02 pm Post subject: |
|
|
| dnsi0 wrote: | Hmm... Is it me or are the C++ directx classes different from the delphi ones? Cause maple is C++ and what I did was C++ using a clean class and it doesn't work? So Should I use C++ to do this?
This is what i have done:
| Code: | library DirectXOverlay;
uses
Windows, Messages, SysUtils, Variants, Classes, StdCtrls, ExtCtrls,psapi,winsvc,DirectXGraphics;
{$R *.res}
var
jumper:pbytearray;
dxHandle:Cardinal;
dxHook:Cardinal;
originalprotection:Cardinal;
function xhDirect3DCreate8(SDKVersion:DWORD):IDirect3D8;
var
hCb:DWORD;
begin
hCb:=Dword(GetProcAddress(dxHandle,'Direct3DCreate8'))+5;
asm
mov edi,edi
push ebp
mov ebp,esp
jmp [hCb]
end;
end;
function xDirect3DCreate8(SDKVersion:DWORD):IDirect3D8;
begin
Result:=xhDirect3DCreate8(SDKVersion);
end;
begin
dxHandle:=GetModuleHandle('d3d8.dll');
dxHook:=Dword(GetProcAddress(dxHandle,'Direct3DCreate8'))+5;
virtualprotect(pointer(dxHook),5,PAGE_EXECUTE_READWRITE,originalprotection);
//Hook Direct3DCreate8
jumper:=pointer(dxHook-5);
jumper[0]:=$E9;
pdword(@jumper[1])^:=dword(@xDirect3DCreate8)-dword(dword(@jumper[0])+$5);
end. |
IDirect3D8 Is a d3d class. |
What part of this doesn't work?
|
|
| Back to top |
|
|
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
| Posted: Sat Oct 18, 2008 12:05 pm Post subject: |
|
|
| The part where you inject it into maple it crashes without error.
|
|
| Back to top |
|
|
Zand
Master Cheater
![]() Reputation: 0
Joined: 21 Jul 2006
Posts: 424
|
| Posted: Sat Oct 18, 2008 12:16 pm Post subject: |
|
|
| Maybe d3d8.dll isn't loaded yet?
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
