EndScene mid function

[AeroMan]

/*
	* Information *
	- Programmed by AeroMan & Znoen!

	* Usage *
	- Distribution and reusing allowed.
	- Credits should be given at any point of time!
	- Status: Unknown

	https://mpgh.net
*/


#define _SOURCE_
#ifdef _SOURCE_


#include <Windows.h>
#include <d3dx9.h>
#include <d3d9.h>

#pragma comment(lib, "d3dx9.lib")
#pragma comment(lib, "d3d9.lib")


ID3DXFont *pfont;

int pReset = 0;

void MenuRender(LPDIRECT3DDEVICE9 pDevice, int FontSize, int Weight, TCHAR *pFontName)
{

	if (pReset == 0){					// If our cReset is NULL
		D3DXCreateFont(pDevice,					// D3D9
			FontSize,							// Font Height
			0,									// Font Width
			Weight,							    // Font Weight
			1,									// Font MapLevel
			0,									// Italic
			DEFAULT_CHARSET,					// CharSet
			OUT_DEFAULT_PRECIS,					// Precis
			DEFAULT_QUALITY,					// Font Quality
			0,									// Pitch And Family
			(LPCWSTR)pFontName,					// Font Name (Arial,Verdana,Courier new,...)
			&pfont);							// pFont
		pReset = 1;
	}					// Our cReset goes to 1
}

DWORD FindDevice(DWORD Len)
{
	DWORD dwObjBase = 0;
	dwObjBase = (DWORD)LoadLibraryA("d3d9.dll");
	while (dwObjBase++ < dwObjBase + Len)
	{
		if ((*(WORD*)(dwObjBase + 0x00)) == 0x06C7 && (*(WORD*)(dwObjBase + 0x06)) == 0x8689 && (*(WORD*)(dwObjBase + 0x0C)) == 0x8689)
		{
			dwObjBase += 2; break;
		}
	}
	return (dwObjBase);
}

DWORD vTableID(int index)
{
	PDWORD VTable;
	*(DWORD*)&VTable = *(DWORD*)FindDevice(0x128000);
	return VTable[index];
}

void DrawString(char * string, int x, int y, int to, D3DCOLOR Color, ID3DXFont * pFont)
{
	RECT pRect;
	SetRect(&pRect, x, y, x, y);

	switch (to)
	{
	case 1:
		pFont->DrawTextA(NULL, string, -1, &pRect, DT_NOCLIP | DT_CENTER, Color);
		break;

	case 0:
		pFont->DrawTextA(NULL, string, -1, &pRect, DT_NOCLIP | DT_RIGHT, Color);
		break;

	case 2:
		pFont->DrawTextA(NULL, string, -1, &pRect, DT_NOCLIP | DT_LEFT, Color);
		break;
	}
}

void PlaceJMP(BYTE * address, DWORD jumpTo, DWORD length)
{
	DWORD oldProtect, newProtect, relativeAddress;
	VirtualProtect(address, length, PAGE_EXECUTE_READWRITE, &oldProtect);
	relativeAddress = (DWORD)(jumpTo - (DWORD)address) - 5;
	*address = 0xE9;
	*((DWORD *)(address + 0x1)) = relativeAddress;
	for (DWORD x = 0x5; x < length; x++)
	{
		*(address + x) = 0x90;
	}
	VirtualProtect(address, length, oldProtect, &newProtect);
}


DWORD dwReJmp = vTableID(42) + 5;
__declspec(naked)HRESULT __stdcall dwEndScene()
{
	static LPDIRECT3DDEVICE9 pDev;

	/* Original code -> 5 first hooking
	695C279F     8BFF           MOV EDI,EDI
	695C27A1   . 55             PUSH EBP
	695C27A2   . 8BEC           MOV EBP,ESP

	 * Modified code jmp to our EndScene
	695C279F  -E9 9C06D9A5      JMP VIP_Base.dwEndScene
	695C27A4   6A FF            PUSH -1
	695C27A6   68 FCAD7369      PUSH d3d9.6973ADFC
	695C27AB   64:A1 00000000   MOV EAX,DWORD PTR FS:[0]
	695C27B1   50               PUSH EAX
	695C27B2   83EC 14          SUB ESP,14
	695C27B5   53               PUSH EBX
	695C27B6   56               PUSH ESI
	*/



	__asm mov edi, edi
	__asm push ebp
	__asm mov ebp, esp
	__asm mov eax, dword ptr ss : [ebp + 0x8]
	__asm mov pDev, eax
	__asm pushad

	if (pDev)
	{
		MenuRender(pDev, 14, 600, (TCHAR*)"Arial");
		DrawString("EndScene hooked!", 50, 50, 2, D3DCOLOR_ARGB(255, 255, 0, 0), pfont);
	}

	__asm popad
	__asm jmp[dwReJmp]
}

DWORD ***********()
{
	HMODULE hDll;

	do{
		hDll = GetModuleHandleA("d3d9.dll");
		Sleep(200);
	} while (!hDll);

	PlaceJMP((PBYTE)vTableID(42), (DWORD)dwEndScene, 5);

	return 0;
}

BOOL WINAPI DllMain(HINSTANCE hDll, DWORD dwReason, LPVOID)
{
	if (dwReason == DLL_PROCESS_ATTACH)
	{
		CreateThread(NULL,
			NULL,
			(LPTHREAD_START_ROUTINE)***********,
			NULL,
			NULL,
			NULL);
	}
	return TRUE;
}

#endif