// ADE32 v2.02c by z0mbie
#ifndef __ADE32_H__
#define __ADE32_H__
#define C_ERROR 0xFFFFFFFF
#define C_ADDR1 0x00000001
#define C_ADDR2 0x00000002
#define C_ADDR4 0x00000004
#define C_LOCK 0x00000008
#define C_67 0x00000010
#define C_66 0x00000020
#define C_REP 0x00000040
#define C_SEG 0x00000080
#define C_ANYPREFIX (C_66+C_67+C_LOCK+C_REP+C_SEG)
#define C_DATA1 0x00000100
#define C_DATA2 0x00000200
#define C_DATA4 0x00000400
#define C_SIB 0x00000800
#define C_ADDR67 0x00001000
#define C_DATA66 0x00002000
#define C_MODRM 0x00004000
#define C_BAD 0x00008000
#define C_OPCODE2 0x00010000
#define C_REL 0x00020000
#define C_STOP 0x00040000
#pragma pack(push)
#pragma pack(1)
struct disasm_struct {
BYTE disasm_defaddr; // 00
BYTE disasm_defdata; // 01
DWORD disasm_len; // 02 03 04 05
DWORD disasm_flag; // 06 07 08 09
DWORD disasm_addrsize; // 0A 0B 0C 0D
DWORD disasm_datasize; // 0E 0F 10 11
BYTE disasm_rep; // 12
BYTE disasm_seg; // 13
BYTE disasm_opcode; // 14
BYTE disasm_opcode2; // 15
BYTE disasm_modrm; // 16
BYTE disasm_sib; // 17
union {
BYTE disasm_addr_b[8]; // 18 19 1A 1B 1C 1D 1E 1F
WORD disasm_addr_w[4];
DWORD disasm_addr_d[2];
char disasm_addr_c[8];
short disasm_addr_s[4];
long disasm_addr_l[2];
};
union {
BYTE disasm_data_b[8]; // 20 21 22 23 24 25 26 27
WORD disasm_data_w[4];
DWORD disasm_data_d[2];
char disasm_data_c[8];
short disasm_data_s[4];
long disasm_data_l[2];
};
}; // disasm_struct
#pragma pack(pop)
int disasm(BYTE* opcode0, disasm_struct* diza);
int oplen(BYTE* opcode);
#endif // __ADE32_H__
as.cpp
/**************************************************************************************************************************************************************************************************************/
#pragma once
#define WIN32_LEAN_AND_MEAN
#include
#include
#include
#include
#include "detoursx.h"
/**************************************************************************************************************************************************************************************************************/
LPDIRECT3DTEXTURE9 texYellow, texRed, texGreen, texBlue, texBlack, texWhite, texPink, texOrange, texLightBlue, texCyan, texPurple, texSteelBlue, texLightSteelBlue, texSalmon, texBrown, texTeal, texLime, texElectricLime, texGold, texOrangeRed, texGreenYellow, texAquaMarine, texSkyBlue, texSlateBlue, texCrimson, texDarkOliveGreen, texPaleGreen, texDarkGoldenRod, texFireBrick, texDarkBlue, texDarkerBlue, texDarkYellow, texLightYellow;
/**************************************************************************************************************************************************************************************************************/
#include
#pragma comment(lib, "d3d9.lib")
bool CekHook=false;
#include
#pragma comment(lib, "d3dx9.lib")
/**************************************************************************************************************************************************************************************************************/
#define D3DparamX , UINT paramx
#define D3DparamvalX , paramx
/**************************************************************************************************************************************************************************************************************/
LPD3DXFONT g_pFont = NULL;
LPDIRECT3DDEVICE9 pDevice = 0;
UINT OffsetInBytes;
UINT m_Stride;
/******** GenerateTexture ******************************************************************************************************************************************************************************************************/
HRESULT GenerateTexture(IDirect3DDevice9 *pD3Ddev, IDirect3DTexture9 **ppD3Dtex, DWORD colour32)
{
if( FAILED(pD3Ddev->CreateTexture(8, 8, 1, 0, D3DFMT_A4R4G4B4, D3DPOOL_MANAGED, ppD3Dtex, NULL)) )
return E_FAIL;
WORD colour16 = ((WORD)((colour32>>28)&0xF)<<12)
|(WORD)(((colour32>>20)&0xF)<<8)
|(WORD)(((colour32>>12)&0xF)<<4)
|(WORD)(((colour32>>4)&0xF)<<0);
D3DLOCKED_RECT d3dlr;
(*ppD3Dtex)->LockRect(0, &d3dlr, 0, 0);
WORD *pDst16 = (WORD*)d3dlr.pBits;
for(int xy=0; xy < 8*8; xy++)
*pDst16++ = colour16;
(*ppD3Dtex)->UnlockRect(0);
return S_OK;
}
/**************************************************************************************************************************************************************************************************************/
PVOID D3Ddiscover(void *tbl, int size)
{
HWND hWnd;
void *pInterface=0 ;
D3DPRESENT_PARAMETERS d3dpp;
if ((hWnd=CreateWindowEx(NULL,WC_DIALOG,"",WS_OVERLAPPED,0,0,50,50,NULL,NULL,NULL,NULL))==NULL) return 0;
ShowWindow(hWnd, SW_HIDE);
LPDIRECT3D9 pD3D;
LPDIRECT3DDEVICE9 pD3Ddev;
if ((pD3D = Direct3DCreate9(D3D_SDK_VERSION))!=NULL)
{
ZeroMemory(&d3dpp, sizeof(d3dpp));
d3dpp.Windowed = TRUE;
d3dpp.SwapEffect = D3DSWAPEFFECT_DISCARD;
d3dpp.hDeviceWindow = hWnd;
d3dpp.BackBufferFormat = D3DFMT_X8R8G8B8;
d3dpp.BackBufferWidth = d3dpp.BackBufferHeight = 600;
pD3D->CreateDevice(D3DADAPTER_DEFAULT,D3DDEVTYPE_HAL,hWnd,D3DCREATE_SOFTWARE_VERTEXPROCESSING,&d3dpp,&pD3Ddev);
if (pD3Ddev) {
pInterface = (PDWORD)*(DWORD *)pD3Ddev;
memcpy(tbl,(void *)pInterface,size);
pD3Ddev->Release();
}
pD3D->Release();
}
DestroyWindow(hWnd);
return pInterface;
}
/**************************************************************************************************************************************************************************************************************/
void EraseHeaders(HINSTANCE hModule)
{
/*
* just a func to erase headers by Croner.
* keep in mind you wont be able to load
* any resources after you erase headers.
*/
PIMAGE_DOS_HEADER pDoH;
PIMAGE_NT_HEADERS pNtH;
DWORD i, ersize, protect;
if (!hModule) return;
// well just to make clear what we doing
pDoH = (PIMAGE_DOS_HEADER)(hModule);
pNtH = (PIMAGE_NT_HEADERS)((LONG)hModule + ((PIMAGE_DOS_HEADER)hModule)->e_lfanew);
ersize = sizeof(IMAGE_DOS_HEADER);
if ( VirtualProtect(pDoH, ersize, PAGE_READWRITE, &protect) )
{
for ( i=0; i < ersize; i++ )
*(BYTE*)((BYTE*)pDoH + i) = 0;
}
ersize = sizeof(IMAGE_NT_HEADERS);
if ( pNtH && VirtualProtect(pNtH, ersize, PAGE_READWRITE, &protect) )
{
for ( i=0; i < ersize; i++ )
*(BYTE*)((BYTE*)pNtH + i) = 0;
}
return;
}
/**************************************************************************************************************************************************************************************************************/
typedef HRESULT (WINAPI* oDrawIndexedPrimitive) (LPDIRECT3DDEVICE9 pDevice, D3DPRIMITIVETYPE Type, INT BaseVertexIndex, UINT MinVertexIndex, UINT NumVertices, UINT startIndex, UINT primCount);
oDrawIndexedPrimitive pDrawIndexedPrimitive;
/**************************************************************************************************************************************************************************************************************/
HRESULT WINAPI myDrawIndexedPrimitive(LPDIRECT3DDEVICE9 pDevice, D3DPRIMITIVETYPE pType D3DparamX ,UINT nMinIndex, UINT nNumVertices, UINT nStartIndex, UINT nPrimitiveCount )
{
__asm
{
mov ecx,[ebp+32]
mov edx,[ebp+28]
PUSHAD;
}
if (Generate)
{
GenerateTexture(pDevice, &texGreen , D3DCOLOR_ARGB(255,0,255,0));
GenerateTexture(pDevice, &texRed , D3DCOLOR_ARGB(255,255,0,0));
GenerateTexture(pDevice, &texBlue , D3DCOLOR_ARGB(255,0,0,255));
GenerateTexture(pDevice, &texOrange , D3DCOLOR_ARGB(255,255,165,0));
GenerateTexture(pDevice, &texYellow , D3DCOLOR_ARGB(255,255,255,0));
GenerateTexture(pDevice, &texPink , D3DCOLOR_ARGB(255,255,192,203));
GenerateTexture(pDevice, &texCyan , D3DCOLOR_ARGB(255,0,255,255));
GenerateTexture(pDevice, &texPurple , D3DCOLOR_ARGB(255,160,32,240));
GenerateTexture(pDevice, &texBlack , D3DCOLOR_ARGB(255,0,0,0));
GenerateTexture(pDevice, &texWhite , D3DCOLOR_ARGB(255,255,255,255));
GenerateTexture(pDevice, &texSteelBlue , D3DCOLOR_ARGB(255,33,104,140));
GenerateTexture(pDevice, &texLightSteelBlue, D3DCOLOR_ARGB(255,201,255,255));
GenerateTexture(pDevice, &texLightBlue , D3DCOLOR_ARGB(255,26,140,306));
GenerateTexture(pDevice, &texSalmon , D3DCOLOR_ARGB(255,196,112,112));
GenerateTexture(pDevice, &texBrown , D3DCOLOR_ARGB(255,168,99,20));
GenerateTexture(pDevice, &texTeal , D3DCOLOR_ARGB(255,38,140,140));
GenerateTexture(pDevice, &texLime , D3DCOLOR_ARGB(255,50,205,50));
GenerateTexture(pDevice, &texElectricLime , D3DCOLOR_ARGB(255,204,255,0));
GenerateTexture(pDevice, &texGold , D3DCOLOR_ARGB(255,255, 215, 0));
GenerateTexture(pDevice, &texOrangeRed , D3DCOLOR_ARGB(255,255,69,0));
GenerateTexture(pDevice, &texGreenYellow , D3DCOLOR_ARGB(255,173,255,47));
GenerateTexture(pDevice, &texAquaMarine , D3DCOLOR_ARGB(255,127,255,212));
GenerateTexture(pDevice, &texSkyBlue , D3DCOLOR_ARGB(255,0,191,255));
GenerateTexture(pDevice, &texSlateBlue , D3DCOLOR_ARGB(255,132, 112, 255));
GenerateTexture(pDevice, &texCrimson , D3DCOLOR_ARGB(255,220,20,60));
GenerateTexture(pDevice, &texDarkOliveGreen, D3DCOLOR_ARGB(255,188,238,104 ));
GenerateTexture(pDevice, &texPaleGreen , D3DCOLOR_ARGB(255,154,255, 154));
GenerateTexture(pDevice, &texDarkGoldenRod , D3DCOLOR_ARGB(255,255, 185, 15 ));
GenerateTexture(pDevice, &texFireBrick , D3DCOLOR_ARGB(255,255,48,48));
GenerateTexture(pDevice, &texDarkBlue , D3DCOLOR_ARGB(255,0,0,204));
GenerateTexture(pDevice, &texDarkerBlue , D3DCOLOR_ARGB(255,0,0,153));
GenerateTexture(pDevice, &texDarkYellow , D3DCOLOR_ARGB(255,255,204,0));
GenerateTexture(pDevice, &texLightYellow , D3DCOLOR_ARGB(255,255,255,153));
Generate = false;
}
LPDIRECT3DVERTEXBUFFER9 Stream_Data;
UINT Offset = 0;
UINT Stride = 0;
if(pDevice->GetStreamSource(0, &Stream_Data, &Offset, &Stride) == D3D_OK) Stream_Data->Release();
/*******************************************************************************************************************************************************************************************************/
if (Stride==44)
{
pDevice->SetRenderState(D3DRS_ZENABLE, D3DZB_FALSE);
pDevice->SetTexture(0, texLightBlue);
pDrawIndexedPrimitive(pDevice,pType D3DparamvalX,nMinIndex,nNumVertices,nStartIndex,nPrimitiveCount);
pDevice->SetRenderState(D3DRS_ZENABLE, D3DZB_TRUE);
}
__asm
popad;
return pDrawIndexedPrimitive(pDevice,pType D3DparamvalX,nMinIndex,nNumVertices,nStartIndex,nPrimitiveCount);
}
/**************************************************************************************************************************************************************************************************************/
void HideModule(HINSTANCE hModule)
{
DWORD dwPEB_LDR_DATA = 0;
_asm
{
pushad;
pushfd;
mov eax, fs:[30h]
mov eax, [eax+0Ch]
mov dwPEB_LDR_DATA, eax
InLoadOrderModuleList:
mov esi, [eax+0Ch]
mov edx, [eax+10h]
LoopInLoadOrderModuleList:
lodsd
mov esi, eax
mov ecx, [eax+18h]
cmp ecx, hModule
jne SkipA
mov ebx, [eax]
mov ecx, [eax+4]
mov [ecx], ebx
mov [ebx+4], ecx
jmp InMemoryOrderModuleList
SkipA:
cmp edx, esi
jne LoopInLoadOrderModuleList
InMemoryOrderModuleList:
mov eax, dwPEB_LDR_DATA
mov esi, [eax+14h]
mov edx, [eax+18h]
LoopInMemoryOrderModuleList:
lodsd
mov esi, eax
mov ecx, [eax+10h]
cmp ecx, hModule
jne SkipB
mov ebx, [eax]
mov ecx, [eax+4]
mov [ecx], ebx
mov [ebx+4], ecx
jmp InInitializationOrderModuleList
SkipB:
cmp edx, esi
jne LoopInMemoryOrderModuleList
InInitializationOrderModuleList:
mov eax, dwPEB_LDR_DATA
mov esi, [eax+1Ch]
mov edx, [eax+20h]
LoopInInitializationOrderModuleList:
lodsd
mov esi, eax
mov ecx, [eax+08h]
cmp ecx, hModule
jne SkipC
mov ebx, [eax]
mov ecx, [eax+4]
mov [ecx], ebx
mov [ebx+4], ecx
jmp Finished
SkipC:
cmp edx, esi
jne LoopInInitializationOrderModuleList
Finished:
popfd;
popad;
}
}
/**************************************************************************************************************************************************************************************************************/
int D3D(void)
{
HINSTANCE hD3D;
DWORD vTable[105];
hD3D=0;
do {
hD3D = GetModuleHandle("d3d9.dll");
if (!hD3D) Sleep(100);
} while(!hD3D);
if (D3Ddiscover((void *)&vTable[0],420)==0) return 0;
{
while(1)
{
if(memcmp((void*)vTable[82],(void*)(PBYTE)"\x8B\xFF",2)== 0)
{
pDrawIndexedPrimitive = (oDrawIndexedPrimitive) DetourCreate((PBYTE)vTable[82], (PBYTE)myDrawIndexedPrimitive, 5);
}
Sleep(50);
}
return 0;
}
}
/**************************************************************************************************************************************************************************************************************/
BOOL WINAPI DllMain(HMODULE hDll, DWORD dwReason, LPVOID lpReserved)
{
DisableThreadLibraryCalls(hDll);
if (dwReason == DLL_PROCESS_ATTACH)
{
HideModule(hDll);
EraseHeaders(hDll);
CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)D3D, NULL, NULL, NULL);
}
else if(dwReason == DLL_PROCESS_DETACH)
{
DetourRemove(pDrawIndexedPrimitive);
return TRUE;
}
return FALSE;
}
/**************************************************************************************************************************************************************************************************************/
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
detoursx.h
/*
Name: DetourXS
Description: DetourXS is a library for function detouring
Version: 1.0
Author: Sinner
Website:
www.gamedefeat.com &
www.cheatersutopia.comCredits: z0mbie (ADE32), LanceVorgin's CDetour (some ideas)
*/
#define WIN32_LEAN_AND_MEAN
#define WIN32_EXTRA_LEAN
#include
#include "ADE32.h"
//#pragma comment(lib, "detourxs")
#include
#define DETOUR_LEN_AUTO 0 // Finds the detour length automatically
enum
{
DETOUR_TYPE_JMP, // min detour len: 5
DETOUR_TYPE_PUSH_RET, // min detour len: 6
DETOUR_TYPE_NOP_JMP, // min detour len: 6
DETOUR_TYPE_NOP_NOP_JMP, // min detour len: 7
DETOUR_TYPE_STC_JC, // min detour len: 7
DETOUR_TYPE_CLC_JNC, // min detour len: 7
};
LPVOID DetourCreate(LPVOID lpFuncOrig, LPVOID lpFuncDetour, int patchType, int detourLen=DETOUR_LEN_AUTO);
LPVOID DetourCreate(LPCSTR lpModuleName, LPCSTR lpProcName, LPVOID lpFuncDetour, int patchType, int detourLen=DETOUR_LEN_AUTO);
BOOL DetourRemove(LPVOID lpDetourCreatePtr);
#pragma warning(disable: 4311)
#pragma warning(disable: 4312)
#pragma warning(disable: 4244)
#define DETOUR_MAX_SRCH_OPLEN 64
#define JMP32_SZ 5
#define BIT32_SZ 4
// jmp32 sig
#define SIG_SZ 3
#define SIG_OP_0 0xCC
#define SIG_OP_1 0x90
#define SIG_OP_2 0xC3
static DWORD dwOldProt;
int GetDetourLen(int patchType);
int GetDetourLenAuto(PBYTE &pbFuncOrig, int minDetLen);
// Thin wrapper for APIs
LPVOID DetourCreate(LPCSTR lpModuleName, LPCSTR lpProcName, LPVOID lpFuncDetour, int patchType, int detourLen)
{
LPVOID lpFuncOrig = NULL;
if((lpFuncOrig = GetProcAddress(GetModuleHandle(lpModuleName), lpProcName)) == NULL)
return NULL;
return DetourCreate(lpFuncOrig, lpFuncDetour, patchType, detourLen);
}
LPVOID DetourCreate(LPVOID lpFuncOrig, LPVOID lpFuncDetour, int patchType, int detourLen)
{
LPVOID lpMallocPtr = NULL;
DWORD dwProt = NULL;
PBYTE pbMallocPtr = NULL;
PBYTE pbFuncOrig = (PBYTE)lpFuncOrig;
PBYTE pbFuncDetour = (PBYTE)lpFuncDetour;
PBYTE pbPatchBuf = NULL;
int minDetLen = 0;
int detLen = 0;
// Get detour length
if((minDetLen = GetDetourLen(patchType)) == 0)
return NULL;
if(detourLen != DETOUR_LEN_AUTO)
detLen = detourLen;
else if((detLen = GetDetourLenAuto(pbFuncOrig, minDetLen)) < minDetLen)
return NULL;
// Alloc mem for the overwritten bytes
if((lpMallocPtr = (LPVOID)malloc(detLen+JMP32_SZ+SIG_SZ)) == NULL)
return NULL;
pbMallocPtr = (PBYTE)lpMallocPtr;
// Enable writing to original
VirtualProtect(lpFuncOrig, detLen, PAGE_READWRITE, &dwProt);
// Write overwritten bytes to the malloc
memcpy(lpMallocPtr, lpFuncOrig, detLen);
pbMallocPtr += detLen;
pbMallocPtr[0] = 0xE9;
*(DWORD*)(pbMallocPtr+1) = (DWORD)((pbFuncOrig+detLen)-pbMallocPtr)-JMP32_SZ;
pbMallocPtr += JMP32_SZ;
pbMallocPtr[0] = SIG_OP_0;
pbMallocPtr[1] = SIG_OP_1;
pbMallocPtr[2] = SIG_OP_2;
// Create a buffer to prepare the detour bytes
pbPatchBuf = new BYTE[detLen];
memset(pbPatchBuf, 0x90, detLen);
switch(patchType)
{
case DETOUR_TYPE_JMP:
pbPatchBuf[0] = 0xE9;
*(DWORD*)&pbPatchBuf[1] = (DWORD)(pbFuncDetour - pbFuncOrig) - 5;
break;
case DETOUR_TYPE_PUSH_RET:
pbPatchBuf[0] = 0x68;
*(DWORD*)&pbPatchBuf[1] = (DWORD)pbFuncDetour;
pbPatchBuf[5] = 0xC3;
break;
case DETOUR_TYPE_NOP_JMP:
pbPatchBuf[0] = 0x90;
pbPatchBuf[1] = 0xE9;
*(DWORD*)&pbPatchBuf[2] = (DWORD)(pbFuncDetour - pbFuncOrig) - 6;
break;
case DETOUR_TYPE_NOP_NOP_JMP:
pbPatchBuf[0] = 0x90;
pbPatchBuf[1] = 0x90;
pbPatchBuf[2] = 0xE9;
*(DWORD*)&pbPatchBuf[3] = (DWORD)(pbFuncDetour - pbFuncOrig) - 7;
break;
case DETOUR_TYPE_STC_JC:
pbPatchBuf[0] = 0xF9;
pbPatchBuf[1] = 0x0F;
pbPatchBuf[2] = 0x82;
*(DWORD*)&pbPatchBuf[3] = (DWORD)(pbFuncDetour - pbFuncOrig) - 7;
break;
case DETOUR_TYPE_CLC_JNC:
pbPatchBuf[0] = 0xF8;
pbPatchBuf[1] = 0x0F;
pbPatchBuf[2] = 0x83;
*(DWORD*)&pbPatchBuf[3] = (DWORD)(pbFuncDetour - pbFuncOrig) - 7;
break;
default:
return NULL;
}
// Write the detour
for(int i=0; i
pbFuncOrig[i] = pbPatchBuf[i];
delete [] pbPatchBuf;
// Reset original mem flags
VirtualProtect(lpFuncOrig, detLen, dwProt, &dwOldProt);
return lpMallocPtr;
}
BOOL DetourRemove(LPVOID lpDetourCreatePtr)
{
PBYTE pbMallocPtr = NULL;
DWORD dwFuncOrig = NULL;
DWORD dwProt = NULL;
int i=0;
if((pbMallocPtr = (PBYTE)lpDetourCreatePtr) == NULL)
return FALSE;
// Find the orig jmp32 opcode sig
for(i=0; i<=DETOUR_MAX_SRCH_OPLEN; i++)
{
if(pbMallocPtr[i] == SIG_OP_0
&& pbMallocPtr[i+1] == SIG_OP_1
&& pbMallocPtr[i+2] == SIG_OP_2)
break;
if(i == DETOUR_MAX_SRCH_OPLEN)
return FALSE;
}
// Calculate the original address
pbMallocPtr += (i-JMP32_SZ+1); // Inc to jmp
dwFuncOrig = *(DWORD*)pbMallocPtr; // Get 32bit jmp
pbMallocPtr += BIT32_SZ; // Inc to end of jmp
dwFuncOrig += (DWORD)pbMallocPtr; // Add this addr to 32bit jmp
dwFuncOrig -= (i-JMP32_SZ); // Dec by detour len to get to start of orig
// Write the overwritten bytes back to the original
VirtualProtect((LPVOID)dwFuncOrig, (i-JMP32_SZ), PAGE_READWRITE, &dwProt);
memcpy((LPVOID)dwFuncOrig, lpDetourCreatePtr, (i-JMP32_SZ));
VirtualProtect((LPVOID)dwFuncOrig, (i-JMP32_SZ), dwProt, &dwOldProt);
// Memory cleanup
free(lpDetourCreatePtr);
return TRUE;
}
int GetDetourLen(int patchType)
{
switch(patchType)
{
case DETOUR_TYPE_JMP:
return 5;
case DETOUR_TYPE_PUSH_RET:
case DETOUR_TYPE_NOP_JMP:
return 6;
case DETOUR_TYPE_NOP_NOP_JMP:
case DETOUR_TYPE_STC_JC:
case DETOUR_TYPE_CLC_JNC:
return 7;
default:
return 0;
}
}
int GetDetourLenAuto(PBYTE &pbFuncOrig, int minDetLen)
{
int len = 0;
PBYTE pbCurOp = pbFuncOrig;
while(len < minDetLen)
{
int i = oplen(pbCurOp);
if(i == 0 || i == -1)
return 0;
if(len > DETOUR_MAX_SRCH_OPLEN)
return 0;
len += i;
pbCurOp += i;
}
return len;
