void CopyCode(PDWORD target, PDWORD newfunc) { Hook dwEhsvc + i3gfx DWORD Jmpto=(DWORD)(newfunc)-(DWORD)target-5; DWORD a; VirtualProtect(target, 8, PAGE_EXECUTE_READWRITE, &a); *(PBYTE)(target)=0xE9; *(PDWORD)((DWORD)(target)+1)=Jmpto; VirtualProtect(target, 8, a, &a); } class CHSBypass { public: char _0x0000[168]; DWORD dwES; char _0x00AC[156]; DWORD dwDIP; }; HMODULE hGfxDx = LoadLibrary(i3GfxDx.dll); DWORD WINAPI HookUndetect5(LPVOID Param) { if (hGfxDx > 0) { DWORD tmp1 = (DWORD)GetProcAddress(hGfxDx, ?g_pRenderContext@@3PAVi3RenderContext@@A); DWORD tmp2 = 0; while(!pGDevice) { if(IsBadReadPtr((PDWORD)tmp1,4)==NULL)tmp2 = *(PDWORD)((DWORD)(tmp1))+ 0x5380; // ?EndRender@i3RenderContext@@QAEXXZ if(IsBadReadPtr((PDWORD)tmp2,4)==NULL) { DWORD OldProtect; VirtualProtect((void*)(tmp2), 4, PAGE_EXECUTE_READWRITE, &OldProtect); memcpy(&pGDevice, (void *)tmp2, 4); VirtualProtect((void*)(tmp2), 4, OldProtect, NULL); } } DWORD *g_pDevice = (DWORD*)pGDevice; g_pDevice = (DWORD*)g_pDevice[0]; while(!pDevice)pDevice = (LPDIRECT3DDEVICE9)(DWORD*)g_pDevice; *(PDWORD)&oEndScene = g_pDevice[42]; *(PDWORD)&oDrawIndexedPrimitive = g_pDevice[82]; CopyCode((PDWORD)(g_pDevice[1] - 5), (PDWORD)(g_pDevice[4] - 5)); CopyCode((PDWORD)(g_pDevice[2] - 5), (PDWORD)(g_pDevice[5] - 5)); CopyCode((PDWORD)(g_pDevice[3] - 5), (PDWORD)(g_pDevice[6] - 5)); CopyCode((PDWORD)(g_pDevice[4] - 5), (PDWORD)hkEndScene); CopyCode((PDWORD)(g_pDevice[5] - 5), (PDWORD)hkDrawIndexedPrimitive); while(1) { DWORD dwEhsvc = (DWORD)GetModuleHandleA(EhSvc.dll) + 0x126F64 + 0x7B; //1008EBA1 . 68 646F1210 PUSH ehsvc.10126F64 ; ASCII Exception Raised (Error : 0x%x) CHSBypass *CHS = *(CHSBypass**)dwEhsvc; g_pDevice[42] = (DWORD)g_pDevice[1] - 5; g_pDevice[82] = (DWORD)g_pDevice[2] - 5; CHS->dwES = g_pDevice[42]; CHS->dwDIP = g_pDevice[82]; Sleep(1000); } } return 0; } BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpvReserved){ if(dwReason == DLL_PROCESS_ATTACH) { DisableThreadLibraryCalls(hModule); HideModule(hModule);//hide module and prevent detection from hackshield EraseHeaders(hModule);//erase header to dispatch any header like function in building from hackshield CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)HookUndetect5, NULL, NULL, NULL); } return TRUE; }
Posted on: Wed, 09 Jul 2014 11:47:49 +0000
Trending Topics
Recently Viewed Topics
© 2015