Skip to content
MPGHThe Dark Arts
/
RegisterLog in
Forum
Community
What's NewLatest posts across the boardTrendingHottest threads right nowSubscribedThreads you follow
Discussion
GeneralIntroductionsEntertainmentDebate FortFlaming & Rage
Board
News & AnnouncementsMPGH TimesSuggestions & HelpGiveaways
More Sections
Art & Graphic DesignProgrammingHackingCryptocurrency
Hacks & Cheats
Games
ValorantCS2 / CS:GOCall of Duty / WarzoneFortniteApex LegendsEscape From Tarkov
+14 moreLeague of LegendsGTA VMinecraftRustROTMGBattlefieldTroveBattleOnCombat ArmsCrossFireBlackshotRuneScapeDayZDead by Daylight
Resources
Game Hacking TutorialsReverse EngineeringGeneral Game HackingAnti-CheatConsole Game Hacking
Tools
Game Hacking ToolsTrainers & CheatsHack/Release NewsNew
Submit a release →Share your cheat, tool, or config with the community.
AINEW
AI Tools
General & DiscussionPrompt EngineeringLLM JailbreaksHotAI Agents & AutomationLocal / Open Models
AI × Gaming
AI Aimbots & VisionML Anti-CheatGame Bots & Automation
Create
AI Coding / Vibe CodingAI Art & MediaAI Voice & TTS
The AI frontier →Where game hacking meets modern machine learning. Jump in.
Marketplace
Buy & Sell
SellingBuyingTradingUser Services
Trust & Safety
Middleman LoungeMarketplace TalkVouch Copy Profiles
Money
Cryptocurrency TalkCurrency ExchangeWork & Job Offers
Start selling →List accounts, services, and goods. Use the middleman to trade safe.
MPGH The Dark Arts

A community for offensive security research, reverse engineering, and AI.

Community

ForumMarketplaceSearch

Account

RegisterLog in

Legal

Privacy PolicyForum RulesHelp & FAQ
© 2026 MPGH · All rights reserved.Built by the community, for the community. For educational purposes onlyContent is shared for security research and education — we don't condone illegal use. You're responsible for complying with applicable laws. Use at your own risk.
Home › Forum › MultiPlayer Game Hacks & Cheats › Other Semi-Popular First Person Shooter Hacks › Warface Hacks & Cheats › Warface Coding & Source Code › Simple Chams [Source]

PostSimple Chams [Source]

Posts 1–7 of 7 · Page 1 of 1
LE
LeHaxzor
Simple Chams [Source]
This is the latest request.
A simple chams with pink in it.
I also included a much better endscene.
Enjoy.

Credits: So many places...
I typed every bit of it...
Just had a lot of projects I was able to look at, chose what I needed..
Trial and error.

You're more than welcome to change the color and logo to your own I don't give a crap, have fun with it.
I can make a really simple menu out of this, or a more complex one, would anyone like a tutorial?



Code:
#pragma comment (lib, "d3dx9.lib")
#pragma comment (lib, "d3d9.lib")

#include <Windows.h>
#include "Colors.h"
#include <d3d9.h>
#include <d3dx9.h>
#include <iostream>
#include <fstream>
#include <detours.h>
#include <stdio.h>
#include <vector>
#include "d3d9types.h"

using namespace std;
bool Generated = false;

//Chams
#pragma intrinsic(_ReturnAddress)
#define Player_ReturnAddress 0x615CCB
//Chams

#define HOOK(func,addy)	o##func = (t##func)DetourFunction((PBYTE)addy,(PBYTE)hk##func)
#define D3D_RELEASE(D3D_PTR) if( D3D_PTR ){ D3D_PTR->Release(); D3D_PTR = NULL; }
#define ES	0
#define DIP	1
#define RES 2

DWORD VTable[3] = { 0 };
DWORD WINAPI FindWin(LPVOID);
DWORD D3DEndScene;
DWORD D3DReset;
DWORD D3DDrawIndexedPrimitive;
DWORD WINAPI VirtualMethodTableRepatchingLoopToCounterExtensionRepatching(LPVOID);
PDWORD Direct3D_VMTable = NULL;

BYTE CodeFragmentES[5] = { 0, 0, 0, 0, 0 };
BYTE CodeFragmentR[5] = { 0, 0, 0, 0, 0 };
BYTE CodeFragmentDIP[5] = { 0, 0, 0, 0, 0 };

HRESULT WINAPI Direct3DCreate9_VMTable(VOID);
HRESULT WINAPI hkReset(LPDIRECT3DDEVICE9, D3DPRESENT_PARAMETERS*);
typedef HRESULT(WINAPI* tEndScene)(LPDIRECT3DDEVICE9 LeHaxzor);
typedef HRESULT(WINAPI* DrawIndexedPrimitive_)(LPDIRECT3DDEVICE9 Device, D3DPRIMITIVETYPE Type, INT BaseVertexIndex, UINT MinIndex, UINT NumVertices, UINT StartIndex, UINT PrimitiveCount);
typedef HRESULT(WINAPI* tDrawIndexedPrimitive)(LPDIRECT3DDEVICE9 LeHaxzor, D3DPRIMITIVETYPE PrimType, INT BaseVertexIndex, UINT MinIndex, UINT NumVertices, UINT StartIndex, UINT PrimitiveCount);
typedef HRESULT(WINAPI* tReset)(LPDIRECT3DDEVICE9, D3DPRESENT_PARAMETERS*);
tReset oReset;
DrawIndexedPrimitive_ oDrawIndexedPrimitive = NULL;
tEndScene oEndScene;


//font
LPD3DXFONT	g_pFont = NULL;
//font

DWORD FindDevice(DWORD Len)
{
	DWORD dwObjBase = 0;

	dwObjBase = (DWORD)LoadLibrary("d3d9.dll");
	while (dwObjBase++ < dwObjBase + Len)
	{
		if ((*(WORD*)(dwObjBase + 0x00)) == 0x06C7
			&& (*(WORD*)(dwObjBase + 0x06)) == 0x8689
			&& (*(WORD*)(dwObjBase + 0x0C)) == 0x8689
			) {
			dwObjBase += 2; break;
		}
	}
	return(dwObjBase);
}

DWORD GetDeviceAddress(int VTableIndex)
{
	PDWORD VTable;
	*(DWORD*)&VTable = *(DWORD*)FindDevice(0x128000);
	return VTable[VTableIndex];
}

//Generate Texture for chams
LPDIRECT3DTEXTURE9 White;
LPDIRECT3DTEXTURE9 Pink;
LPDIRECT3DTEXTURE9 Black;
LPDIRECT3DTEXTURE9 Blue;
LPDIRECT3DTEXTURE9 Red;
LPDIRECT3DTEXTURE9 Yellow;
LPDIRECT3DTEXTURE9 Green;
LPDIRECT3DTEXTURE9 Purple;
LPDIRECT3DTEXTURE9 Cyan;
LPDIRECT3DTEXTURE9 Turquoise;
LPDIRECT3DTEXTURE9 Orange;
//Generate Texture for chams
//Color for menu
//Color for menu



//----------------------------------------------------------------------------------------------------//
//Drawing
void DrawShadowText(int x, int y, D3DCOLOR color, char* String)
{
	RECT Font;
	Font.bottom = 0;
	Font.left = x;
	Font.top = y;
	Font.right = 0;

	RECT Fonts;
	Fonts.bottom = 0;
	Fonts.left = x + 1;
	Fonts.top = y + 1;
	Fonts.right = 0;

	g_pFont->DrawTextA(0, String, strlen(String), &Fonts, DT_NOCLIP, 0xFF010101);
	g_pFont->DrawTextA(0, String, strlen(String), &Font, DT_NOCLIP, color);
}
void DrawString(int x, int y, D3DCOLOR color, const char *fmt, ...)
{
	RECT FontPos = { x, y, x + 120, y + 16 };
	char buf[1024] = { '\0' };
	va_list va_alist;

	va_start(va_alist, fmt);
	vsprintf_s(buf, fmt, va_alist);
	va_end(va_alist);

	g_pFont->DrawText(NULL, buf, -1, &FontPos, DT_NOCLIP, color);
}
//Drawing


//Generate Texture for chams
HRESULT GenerateTexture(LPDIRECT3DDEVICE9 LeHaxzor, IDirect3DTexture9 **ppD3Dtex, DWORD colour32)
{
	if (FAILED(LeHaxzor->CreateTexture(8, 8, 1, 0, D3DFMT_A4R4G4B4, D3DPOOL_MANAGED, ppD3Dtex, NULL)))
		return E_FAIL;

	WORD colour16 = ((WORD)((colour32 >> 28) & 0xF) << 12)
		| (WORD)(((colour32 >> 20) & 0xF) << 8)
		| (WORD)(((colour32 >> 12) & 0xF) << 4)
		| (WORD)(((colour32 >> 4) & 0xF) << 0);

	D3DLOCKED_RECT d3dlr;
	(*ppD3Dtex)->LockRect(0, &d3dlr, 0, 0);
	WORD *pDst16 = (WORD*)d3dlr.pBits;

	for (int xy = 0; xy < 8 * 8; xy++)
		*pDst16++ = colour16;

	(*ppD3Dtex)->UnlockRect(0);

	return S_OK;
}
//Generate Texture for chams

HRESULT WINAPI hkDrawIndexedPrimitive(LPDIRECT3DDEVICE9 LeHaxzor, D3DPRIMITIVETYPE PrimType, INT BaseVertexIndex, UINT MinIndex, UINT NumVertices, UINT StartIndex, UINT PrimitiveCount)
{
	//DIP

	//Chams
	void* ReturnAddress = _ReturnAddress();
	if (ReturnAddress != NULL && ReturnAddress == (void *)Player_ReturnAddress)
	{
		LeHaxzor->SetTexture(0, Pink);
		LeHaxzor->SetRenderState(D3DRS_ZENABLE, false);
		LeHaxzor->DrawIndexedPrimitive(PrimType, BaseVertexIndex, MinIndex, NumVertices, StartIndex, PrimitiveCount);
		LeHaxzor->SetRenderState(D3DRS_ZENABLE, true);
		LeHaxzor->SetTexture(0, Turquoise);
	}
	//Chams

	return oDrawIndexedPrimitive(LeHaxzor, PrimType, BaseVertexIndex, MinIndex, NumVertices, StartIndex, PrimitiveCount);
}

HRESULT WINAPI hkReset(LPDIRECT3DDEVICE9 LeHaxzor, D3DPRESENT_PARAMETERS* PresP)
{
	//Reset
	D3D_RELEASE(g_pFont);

	return oReset(LeHaxzor, PresP);
}

HRESULT WINAPI hkEndScene(LPDIRECT3DDEVICE9 LeHaxzor)
{
	if (g_pFont == NULL) D3DXCreateFont(LeHaxzor, 15, 0, FW_BOLD, 1, 0, DEFAULT_CHARSET, OUT_DEFAULT_PRECIS, ANTIALIASED_QUALITY, DEFAULT_PITCH | FF_DONTCARE, "red", &g_pFont);


		//Menu Start
		DrawShadowText(100, 100, D3DCOLOR_ARGB(255, 0, 255, 255), "LeHaxzor made this shit from scratch"); // Cyan
		//Menu End

		//Chams
		if (!Generated) {
			if (Red == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&red, sizeof(red), &Red);
			if (Orange == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&orange, sizeof(orange), &Orange);
			if (Green == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&bGreen, sizeof(bGreen), &Green);
			if (Blue == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&bBlue, sizeof(bBlue), &Blue);
			if (White == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&bWhite, sizeof(bWhite), &White);
			if (Yellow == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&bYellow, sizeof(bYellow), &Yellow);
			if (Pink == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&bPink, sizeof(bPink), &Pink);
			if (Turquoise == NULL)D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&bTur, sizeof(bTur), &Turquoise);
			if (Black == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&bBlack, sizeof(bBlack), &Black);
			//Chams
			Generated = true;
		}


	return oEndScene(LeHaxzor);
}


LRESULT CALLBACK MsgProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
	return DefWindowProc(hwnd, uMsg, wParam, lParam); 
}
void DX_Init(DWORD* table)
{
	WNDCLASSEX wc = { sizeof(WNDCLASSEX), CS_CLASSDC, MsgProc, 0L, 0L, GetModuleHandle(NULL), NULL, NULL, NULL, NULL, "DX", NULL };
	RegisterClassEx(&wc);
	HWND hWnd = CreateWindow("DX", NULL, WS_OVERLAPPEDWINDOW, 100, 100, 300, 300, GetDesktopWindow(), NULL, wc.hInstance, NULL);
	LPDIRECT3D9 pD3D = Direct3DCreate9(D3D_SDK_VERSION);
	D3DPRESENT_PARAMETERS d3dpp;
	ZeroMemory(&d3dpp, sizeof(d3dpp));
	d3dpp.Windowed = TRUE;
	d3dpp.SwapEffect = D3DSWAPEFFECT_DISCARD;
	d3dpp.BackBufferFormat = D3DFMT_UNKNOWN;
	LPDIRECT3DDEVICE9 pd3dDevice;
	pD3D->CreateDevice(D3DADAPTER_DEFAULT, D3DDEVTYPE_HAL, hWnd, D3DCREATE_SOFTWARE_VERTEXPROCESSING, &d3dpp, &pd3dDevice);
	DWORD* pVTable = (DWORD*)pd3dDevice;
	pVTable = (DWORD*)pVTable[0];

	table[ES] = pVTable[42];
	table[DIP] = pVTable[82];
	table[RES] = pVTable[16];

	DestroyWindow(hWnd);
}

//Hook
DWORD WINAPI MyThread(LPVOID)
{
	while (GetModuleHandle("d3d9.dll") == NULL) {
		Sleep(250);
	}

	DX_Init(VTable);

	HOOK(EndScene, VTable[ES]);
	HOOK(DrawIndexedPrimitive, VTable[DIP]);
	HOOK(Reset, VTable[RES]);

	return 0;
}

BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpvReserved)
{
	if (dwReason == DLL_PROCESS_ATTACH) {

		CreateThread(0, 0, MyThread, 0, 0, 0);
	}

	return TRUE;
}

- - - Updated - - -

For No smoke no fog.
At top
#define Smoke 0X619DA0


In DIP
if (ReturnAddress != NULL && ReturnAddress == (void *)Smoke)
{
return D3D_OK;
}
#1 · edited 10y ago · 10y ago
AC
acidzxx
where to paste code at?
#2 · 10y ago
LE
LeHaxzor
Visual Studio 2015.
#3 · 10y ago
Picobello
Picobello
Hi LeHaxzor,

Nice work dude.

I am a D3D hack coder myself and I have a question regarding your work:

Why do you use the return address to identify the model?
Doing so, the hack won't work every time there is an update of the game right? (compilation changes the address space and so the return address)
Why not using the models parameters instead which would make the hack surviving any upcoming update?

Thanks dude
#4 · 10y ago
LE
LeHaxzor
Quote Originally Posted by Picobello View Post
Hi LeHaxzor,

Nice work dude.

I am a D3D hack coder myself and I have a question regarding your work:

Why do you use the return address to identify the model?
Doing so, the hack won't work every time there is an update of the game right? (compilation changes the address space and so the return address)
Why not using the models parameters instead which would make the hack surviving any upcoming update?

Thanks dude

I tried logging model rec and it doesn't work.. and I'm not entirely sure how to do pSizeOfData;

But do you mean something like this?
Code:
	int MyStride;
	if ((NumVertices == 128 && PrimitiveCount == 120 && MyStride == 16)) {
		LeHaxzor->SetTexture(0, Orange);
		LeHaxzor->SetRenderState(D3DRS_ZENABLE, false);
		LeHaxzor->DrawIndexedPrimitive(PrimType, BaseVertexIndex, MinIndex, NumVertices, StartIndex, PrimitiveCount);
		LeHaxzor->SetRenderState(D3DRS_ZENABLE, true);
		LeHaxzor->SetTexture(0, Turquoise);
	}
#5 · edited 10y ago · 10y ago
Picobello
Picobello
Quote Originally Posted by LeHaxzor View Post
But do you mean something like this?
Code:
	int MyStride;
	if ((NumVertices == 128 && PrimitiveCount == 120 && MyStride == 16)) {
		LeHaxzor->SetTexture(0, Orange);
		LeHaxzor->SetRenderState(D3DRS_ZENABLE, false);
		LeHaxzor->DrawIndexedPrimitive(PrimType, BaseVertexIndex, MinIndex, NumVertices, StartIndex, PrimitiveCount);
		LeHaxzor->SetRenderState(D3DRS_ZENABLE, true);
		LeHaxzor->SetTexture(0, Turquoise);
	}
That's right !
I believe you LeHaxzor: sometimes the models are so fragmented that it is not possible to do that way

I compiled you code.
It works great but ...
I have a little problem - Can you help me?

In windowed mode: everything is OK when I inject
In Full Screen mode: just after the injection the game is back to full screen automatically but it does not have the mouse focus. The mouse focus stays with the background apps to which I don't have access because of the game in full screen.
So I am forced to play in windowed mode.
I tried several injectors: Winject, RemoteDLL, Extreme Injector, etc -> All give that same problem

Do you have that problem in Full Screen?
Do you have a walk around this prob?

Thanks man.
#6 · 10y ago
LE
LeHaxzor
Quote Originally Posted by Picobello View Post
That's right !
I believe you LeHaxzor: sometimes the models are so fragmented that it is not possible to do that way

I compiled you code.
It works great but ...
I have a little problem - Can you help me?

In windowed mode: everything is OK when I inject
In Full Screen mode: just after the injection the game is back to full screen automatically but it does not have the mouse focus. The mouse focus stays with the background apps to which I don't have access because of the game in full screen.
So I am forced to play in windowed mode.
I tried several injectors: Winject, RemoteDLL, Extreme Injector, etc -> All give that same problem

Do you have that problem in Full Screen?
Do you have a walk around this prob?

Thanks man.
Yeah, Use windowed mode...

No, I don't have that problem.
#7 · 10y ago
Posts 1–7 of 7 · Page 1 of 1

Post a Reply

Similar Threads

  • [Source] Simple chams for WarfaceBy LeHaxzor in Warface Coding & Source Code
    3Last post 10y ago
  • Flash² - Simple Chams 1.1 - CoderNever Source.By Flash² in Combat Arms Hacks & Cheats
    55Last post 16y ago
  • My Cham sourceBy Andyklk2009 in Combat Arms Hacks & Cheats
    12Last post 18y ago
  • Simple Chams v1.1 With Menu By (by Silex)By silentrunner2 in Combat Arms Europe Hacks
    73Last post 17y ago
  • simple chams problemBy NAV33D in Combat Arms Europe Hacks
    20Last post 17y ago

Tags for this Thread

None