Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


D3D Overlay
Goto page Previous  1, 2, 3  Next
 
Post new topic   This topic is locked: you cannot edit posts or make replies.    Cheat Engine Forum Index -> General programming
View previous topic :: View next topic  
Author Message
GMZorita
Grandmaster Cheater Supreme
Reputation: 0

Joined: 21 Mar 2007
Posts: 1361
PostPosted: Tue Nov 18, 2008 2:16 pm    Post subject: Reply with quote
oib111 wrote:
Tombana, do you mind if I could have the source for the one you wrote?

I would like to have it too if you dont mind, really want to learn it :?
_________________
Gone
Back to top
View user's profile Send private message
Fuzz
Grandmaster Cheater
Reputation: 0

Joined: 12 Nov 2006
Posts: 531
PostPosted: Tue Nov 18, 2008 4:29 pm    Post subject: Reply with quote
They have a lot of tutorials on warrockhacks.com for d3d overlays, used a few when i played, maybe you should check it out
Back to top
View user's profile Send private message AIM Address
dnsi0
I post too much
Reputation: 0

Joined: 04 Jan 2007
Posts: 2674
PostPosted: Tue Nov 18, 2008 5:42 pm    Post subject: Reply with quote
oib111 wrote:
Tombana, do you mind if I could have the source for the one you wrote?


Lol... Mine has the same concept as his. He told me the concept behind redirecting the pointers. My original one was rewriting the entire interface @.@
Back to top
View user's profile Send private message
tombana
Master Cheater
Reputation: 2

Joined: 14 Jun 2007
Posts: 456
Location: The Netherlands
PostPosted: Wed Nov 19, 2008 11:22 am    Post subject: Reply with quote
I cleaned up my source a bit, but it's still a bit messy.
This code:
- Loads a texture from resource
- Draws this texture as an ingame window
- Draws text on the window (options for your hack)
- Intercepts mouse clicks so users can click on the window and change settings
- Is not detected by gameguard

Code:

//Written by Tombana
//Please give credits if you use (a part of) it
#include <windows.h>
#include <d3dx9.h>
#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "d3dx9.lib")

HINSTANCE hInstance;

DWORD D3DC9 = (DWORD)GetProcAddress(GetModuleHandle("d3d9.dll"), "Direct3DCreate9");
IDirect3D9 * (__stdcall * RealDirect3DCreate9)(UINT SDKVersion) = Direct3DCreate9;
HRESULT (__stdcall* RealCreateDevice)(IDirect3D9* _THIS_, UINT Adapter,D3DDEVTYPE DeviceType,HWND hFocusWindow,DWORD BehaviorFlags,D3DPRESENT_PARAMETERS* pPresentationParameters,IDirect3DDevice9** ppReturnedDeviceInterface);
HRESULT (__stdcall* RealEndScene)(IDirect3DDevice9*);
DWORD OldProt;

LPDIRECT3D9 g_pD3D; //The Direct3D interface
LPDIRECT3DDEVICE9 g_pD3DDevice; //The Direct3DDevice interface
LPDIRECT3DTEXTURE9 g_pTexture; //The texture interface
LPD3DXFONT m_font; //The font interface
LPD3DXSPRITE m_sprite; //The sprite interface
D3DXVECTOR3 Position(0.0f, 115.0f, 0.00f); //The position of the window that is drawn
D3DXVECTOR3 Position2(237.0f, 121.0f, 0.00f); //The position of the unhide button that is drawn when the window is hidden
UINT Height, Width; //The with and the height of the game's window (not the window I draw)
HWND hWnd; //Window handle to the window
WNDPROC OldWindowProc; //The original window procedure
bool Hidden; //If the drawn window is hidden

char Buffer[256]; //A buffer for text

RECT rct = {0, 0, 1024, 768}, srcrct = {237, 6, 236+13, 5+12}; //A rect structure used by the DrawText function

int DoText( LPCSTR Text ){
   return m_font->DrawTextA(m_sprite, Text, -1, &rct, 0, D3DCOLOR_ARGB(230, 10, 10, 10));
}

HRESULT __stdcall MyEndScene(IDirect3DDevice9* _THIS_){
   if( SUCCEEDED(m_sprite->Begin(D3DXSPRITE_ALPHABLEND)) ){

      //Draw some text at the right-bottom:
      rct.top = (Height - 15); rct.left = (Width - 150);
      DoText( "Tombana's h4x Industries!", D3DCOLOR_XRGB(10, 10, 10) );

      if( Hidden ){ //Only draw a small unhide button
         rct.top = 125;
         rct.left = 210;
         m_sprite->Draw(g_pTexture, &srcrct, NULL, &Position2, D3DCOLOR_ARGB(230,255,255,255));
      }else{ //Draw the whole window:
         m_sprite->Draw(g_pTexture, NULL, NULL, &Position, D3DCOLOR_ARGB(230,255,255,255));
         
         //Draw some settings of the bot:
         rct.top = 140;
         rct.left = 20;
         if( InstaTele ) DoText( "Teleport: On" );
         else DoText( "Teleport: Off" );
         rct.top += 15;
         if( PickUpBot ) DoText ( "PickUp items: On" );
         else DoText( "PickUp items: Off" );
         rct.top += 15;
         if( HealBot ) DoText( "HealBot: On" );
         else DoText( "HealBot: Off" );
         rct.top += 15;
         wsprintf(Buffer, "Minimum target HP: %d", HealBotHP);
         DoText( Buffer );
         rct.top += 15;
         if( EatBot ) DoText( "EatBot: On" );
         else DoText( "EatBot: Off" );
         rct.top += 15;
         wsprintf(Buffer, "Minimum HP: %d", EatBotHP);
         DoText( Buffer );
         rct.top += 15;
         wsprintf(Buffer, "Minimum MP/FP: %d", EatBotMPFP);
         DoText( Buffer );
         rct.top += 15;
         if( FightBot ) DoText( "FightBot: On" );
         else DoText( "FightBot: Off" );
      }
      m_sprite->End();
   }
   //Call the real EndScene function
   return RealEndScene(_THIS_);
}

//This will be called instead of the original window procedure.
//If it sees that a mouseclick is made in the window I've drawn,
//It will take the appropriate action and not send the click to the game.
//The coordinates used here are probably wrong.... because
//I removed some stuff inbetween
LRESULT CALLBACK FlyffWindowProc(HWND hWnd, UINT Message, WPARAM wParam, LPARAM lParam)
{
   bool Processed = false;;
   if ( Message == WM_LBUTTONDOWN ){
      WORD x = LOWORD(lParam);
      WORD y = HIWORD(lParam);
      if( x > 236 && x < 250 && y > 120 && y < 133 ){
         Hidden ? Hidden = false : Hidden = true;
         Processed = true;
      }else{
         if( !Hidden ){
            if( x > 0 && x < 256 && y > 115 && y < 371 ){
               if ( x > 140 && x < 240 ){
                  if( y > 153 && y < 168 ){
                     if( InstaTele ) InstaTele = false;
                     else InstaTele = true;
                  }else if( y > 153+15 && y < 168+15 ){
                     PickUpBot ? PickUpBot = false : PickUpBot = true;
                  }
               }
               if( x > 90 && x < 250 ){
                  if( y > 227 && y < 243 ){
                     HealBot ? HealBot = false : HealBot = true;
                  }else if( y > 227+30 && y < 243+30 ){
                     EatBot ? EatBot = false : EatBot = true;
                  }else if( y > 227+75 && y < 243+75 ){
                     if( FightBot ) FightBot = false;
                     else FightBot = true;
                  }
               }
               Processed = true;
            }
         }
      }
   }
   if( Processed ) return false;
   return CallWindowProc(OldWindowProc, hWnd, Message, wParam, lParam);
}

HRESULT __stdcall MyCreateDevice(IDirect3D9* _THIS_, UINT Adapter,D3DDEVTYPE DeviceType,HWND hFocusWindow,DWORD BehaviorFlags,D3DPRESENT_PARAMETERS* pPresentationParameters,IDirect3DDevice9** ppReturnedDeviceInterface){
   OutputDebugStr("CreateDevice called");

   //Restore the CreateDevice function
   //SOMEHOW THE GAME FREEZES WHEN DOING THIS SO I REMOVED IT
   //*(DWORD*)( *(DWORD*)g_pD3D + 0x40 ) = RealCreateDevice;
   //VirtualProtect( (LPVOID)(*(DWORD*)g_pD3D + 0x40) , sizeof(DWORD), OldProt, &OldProt);

   //Call the original CreateDevice
   HRESULT retval = RealCreateDevice(_THIS_, Adapter,DeviceType,hFocusWindow,BehaviorFlags,pPresentationParameters,ppReturnedDeviceInterface);
   g_pD3DDevice = *ppReturnedDeviceInterface;

   //Save the address of the real EndScene function
   *(DWORD*)&RealEndScene = *(DWORD*)( (*(DWORD*)g_pD3DDevice) + 0xA8 );
   //Replace the EndScene function with our own
   *(DWORD*)( (*(DWORD*)g_pD3DDevice) + 0xA8 ) = (DWORD)MyEndScene;

   //Get width/height and window handle
   D3DVIEWPORT9 Viewport;
   D3DDEVICE_CREATION_PARAMETERS Parameters;
   g_pD3DDevice->GetViewport(&Viewport);
   g_pD3DDevice->GetCreationParameters(&Parameters);
   Height = rct.bottom = Viewport.Height;
   Width = rct.right = Viewport.Width;
   hWnd = Parameters.hFocusWindow;
   //Subclass the window to intercept mouseclicks for the window
   OldWindowProc = (WNDPROC)SetWindowLong(hFlyffWnd, GWL_WNDPROC, (LONG)FlyffWindowProc);

   wsprintf(Buffer, "Viewport size: %d * %d", Width, Height);
   OutputDebugString(Buffer);

   //Create a font
   D3DXCreateFontA(g_pD3DDevice, 15, 0, FW_DONTCARE, 0, false, DEFAULT_CHARSET, OUT_DEFAULT_PRECIS, DEFAULT_QUALITY, DEFAULT_PITCH | FF_DONTCARE, "Arial", &m_font);
   //Create a sprite
   D3DXCreateSprite(g_pD3DDevice, &m_sprite);
   //Load a texture (you can use D3DXCreateTextureFromFileEx if you want to load it from a file)
   D3DXCreateTextureFromResourceEx(g_pD3DDevice, (HMODULE)hInstance, "FlyffBox",
                           D3DX_DEFAULT, D3DX_DEFAULT, D3DX_DEFAULT,
                           NULL, D3DFMT_A8B8G8R8, D3DPOOL_MANAGED,
                           D3DX_DEFAULT, D3DX_DEFAULT, D3DCOLOR_XRGB(255,0,255), //Have pink as the transparant color
                           NULL, NULL, &g_pTexture);
   return retval;
}

//This is called instead of the real Direct3DCreate9 by a simple inline hook of the api.
IDirect3D9 * WINAPI MyDirect3DCreate9(UINT SDKVersion){
   OutputDebugString("Direct3DCreate9 called");

   //Restore the first 5 bytes of the original function (mov edi, edi; push ebp; mov ebp, esp)
   *(PBYTE)D3DC9 = 0x8B;
   *(PDWORD)(D3DC9+1) = 0xEC8B55FF;

   //Call real function
   g_pD3D = RealDirect3DCreate9(SDKVersion);
   
   //The returned interface is not writable... so change that:
   VirtualProtect( (LPVOID)(*(DWORD*)g_pD3D + 0x40) , sizeof(DWORD), PAGE_EXECUTE_READWRITE, &OldProt);
   //Save the address of the real CreateDevice function
   //I wanted to do it like this:
   //     RealCreateDevice = (DWORD) ( (*g_pD3D).CreateDevice ) ;
   //But I tried several things and they didn't work.
   //So I had to use manual offsets:
   *(DWORD*)&RealCreateDevice = *(DWORD*) ( *(DWORD*)g_pD3D + 0x40 ); //40 is offset to CreateDevice.
   //Replace the CreateDevice member of the interface with our own function
   *(DWORD*) ( *(DWORD*)g_pD3D + 0x40 ) = (DWORD)MyCreateDevice;

   return g_pD3D;
}

//This thread is nessecary for the EndScene hook to stay in place.
//Sometimes when you call a D3DX function the hook is restored
int WINAPI MyThread(DWORD lParam){
   while( 1 ){
         Sleep(100);
         if( RealEndScene ){ //If the hook as been applied it could have been unhooked
            if( *(DWORD*)( (*(DWORD*)g_pD3DDevice) + 0xA8 ) != (DWORD)MyEndScene ){ //If unhooked (sometimes happens when the complete scene is changed)
               *(DWORD*)( (*(DWORD*)g_pD3DDevice) + 0xA8 ) = (DWORD)MyEndScene;
               OutputDebugStr("EndScene hook was restored by app, so rehooked it");
            }
         }
   }
   return 0;
}

BOOL WINAPI DllMain(HINSTANCE hinst, DWORD dwReason, LPVOID reserved)
{
   if (dwReason == DLL_PROCESS_ATTACH){
      //Hook Direct3DCreate9 with a simple jmp
      VirtualProtect((LPVOID)D3DC9, 5, PAGE_EXECUTE_READWRITE, &OldProt);
      *(PBYTE)D3DC9 = 0xE9;
      *(PDWORD)(D3DC9+1) = (DWORD)MyDirect3DCreate9 - (DWORD)D3DC9 - 5;
      hInstance = hinst;
      DisableThreadLibraryCalls(hinst);
      CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)MyThread, 0, 0, NULL);
   }else if(dwReason == DLL_PROCESS_DETACH){
      //Cleanup all the directx stuff to prevent memory leak and so on
      if( g_pTexture ) g_pTexture->Release();
      if( m_font ) m_font->Release();
      if( m_sprite ) m_sprite->Release();
   }
    return TRUE;
}


I can imagine that a lot of people don't understand my messy code so feel free to ask anything you want.
Back to top
View user's profile Send private message
&Vage
Grandmaster Cheater Supreme
Reputation: 0

Joined: 25 Jul 2008
Posts: 1053
PostPosted: Wed Nov 19, 2008 3:46 pm    Post subject: Reply with quote
MapleStory doesn't let you use proxy dlls.
Back to top
View user's profile Send private message
Odecey
Master Cheater
Reputation: 1

Joined: 19 Apr 2007
Posts: 259
Location: Scandinavia
PostPosted: Wed Nov 19, 2008 4:16 pm    Post subject: Reply with quote
Simple question: How does a proxy dll differ from "normal" ones?
_________________
Never confuse activity with productivity. You can be busy without a purpose, but what's the point?- Rick Warren
Back to top
View user's profile Send private message MSN Messenger
sponge
I'm a spammer
Reputation: 1

Joined: 07 Nov 2006
Posts: 6009
PostPosted: Wed Nov 19, 2008 5:23 pm    Post subject: Reply with quote
Odecey wrote:
Simple question: How does a proxy dll differ from "normal" ones?
A proxy dll leads to the real dll however... it is edited to do a few things.
_________________
Back to top
View user's profile Send private message
Odecey
Master Cheater
Reputation: 1

Joined: 19 Apr 2007
Posts: 259
Location: Scandinavia
PostPosted: Wed Nov 19, 2008 5:33 pm    Post subject: Reply with quote
So it's a dll that hooks some of the functions of the original dll? How come this does not work for MS? I heard something about MS using its own set of dlls.
_________________
Never confuse activity with productivity. You can be busy without a purpose, but what's the point?- Rick Warren
Back to top
View user's profile Send private message MSN Messenger
sponge
I'm a spammer
Reputation: 1

Joined: 07 Nov 2006
Posts: 6009
PostPosted: Wed Nov 19, 2008 5:44 pm    Post subject: Reply with quote
GameGuard checks for proxy dlls, as does MapleStory itself. (Some files should be in system32, but putting the same name dll in the folder will force that dll to load.)
_________________
Back to top
View user's profile Send private message
tombana
Master Cheater
Reputation: 2

Joined: 14 Jun 2007
Posts: 456
Location: The Netherlands
PostPosted: Thu Nov 20, 2008 4:13 am    Post subject: Reply with quote
My code is not a proxy dll. AFAIC a proxy dll is a dll which has the complete original interface rewritten and forwards all the functions.
My dll only changes some of the addresses in the interface to point to my own functions. There is no hooking involved with inline jumps. (Only in the very beginning, but that hook is removed right away).
As I said, the code I posted is not detected by gameguard.
Back to top
View user's profile Send private message
&Vage
Grandmaster Cheater Supreme
Reputation: 0

Joined: 25 Jul 2008
Posts: 1053
PostPosted: Thu Nov 20, 2008 3:29 pm    Post subject: Reply with quote
tombana wrote:
My code is not a proxy dll. AFAIC a proxy dll is a dll which has the complete original interface rewritten and forwards all the functions.
My dll only changes some of the addresses in the interface to point to my own functions. There is no hooking involved with inline jumps. (Only in the very beginning, but that hook is removed right away).
As I said, the code I posted is not detected by gameguard.


It's not detected by GameGuard because it's already prevented by GameGuard. You're detouring the CreateDevice to you're own function, that isn't proxying?
Back to top
View user's profile Send private message
BanMe
Master Cheater
Reputation: 0

Joined: 29 Nov 2005
Posts: 375
Location: Farmington NH, USA
PostPosted: Thu Nov 20, 2008 3:38 pm    Post subject: Reply with quote
if proxy's fail go with PEB hooking Wink the same basis of Proxy Dll's but redirected through the PEB Very Happy
Back to top
View user's profile Send private message MSN Messenger
tombana
Master Cheater
Reputation: 2

Joined: 14 Jun 2007
Posts: 456
Location: The Netherlands
PostPosted: Fri Nov 21, 2008 4:21 am    Post subject: Reply with quote
_void_ wrote:
tombana wrote:
My code is not a proxy dll. AFAIC a proxy dll is a dll which has the complete original interface rewritten and forwards all the functions.
My dll only changes some of the addresses in the interface to point to my own functions. There is no hooking involved with inline jumps. (Only in the very beginning, but that hook is removed right away).
As I said, the code I posted is not detected by gameguard.


It's not detected by GameGuard because it's already prevented by GameGuard. You're detouring the CreateDevice to you're own function, that isn't proxying?

Yes it's proxying but it's only proxying one function. I think that normally speaking, a proxy dll means that every function is proxied.
And how do you mean it's already prevented by gameguard? It works completely fine...
Back to top
View user's profile Send private message
&Vage
Grandmaster Cheater Supreme
Reputation: 0

Joined: 25 Jul 2008
Posts: 1053
PostPosted: Fri Nov 21, 2008 7:17 am    Post subject: Reply with quote
How do you know it works for a gameguard protected game?
Back to top
View user's profile Send private message
tombana
Master Cheater
Reputation: 2

Joined: 14 Jun 2007
Posts: 456
Location: The Netherlands
PostPosted: Fri Nov 21, 2008 8:26 am    Post subject: Reply with quote
Well.... I use the code for my flyff bot and I got a working ingame hack menu. And it has never DC'd me or gave me 'hack attempt detected' and I've run it for hours, so I don't think it's detected in any way.
Flyff uses gameguard rev 1209 by the way.

Also, they probably won't patch stuff like this because it's also used by programs like Xfire. And drawing stuff over your game screen isn't really hacking, it's the rest of your hack/bot that matters for gameguard.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   This topic is locked: you cannot edit posts or make replies.    Cheat Engine Forum Index -> General programming All times are GMT - 6 Hours
Goto page Previous  1, 2, 3  Next
Page 2 of 3

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites