Code:
#include <Windows.h>
#include <d3d9.h>
#pragma comment (lib, "d3d9.lib")
bool ghost = true;
typedef HRESULT(WINAPI* DrawIndexedPrimitive_)(LPDIRECT3DDEVICE9 pDevice, D3DPRIMITIVETYPE Type, INT BaseVertexIndex, UINT MinIndex, UINT NumVertices, UINT StartIndex, UINT PrimitiveCount);
DrawIndexedPrimitive_ pDrawIndexedPrimitive;
HRESULT WINAPI nDrawIndexedPrimitive(LPDIRECT3DDEVICE9 pDevice, D3DPRIMITIVETYPE Type, INT BaseVertexIndex, UINT MinIndex,UINT NumVertices, UINT StartIndex, UINT PrimitiveCount)
{
if (ghost)
{
pDevice->SetRenderState(D3DRS_LIGHTING, false);
pDevice->SetRenderState(D3DRS_AMBIENT,D3DCOLOR_ARGB(255, 255,255,255));
}
else
pDevice->SetRenderState(D3DRS_AMBIENT, false);
return pDrawIndexedPrimitive(pDevice, Type, BaseVertexIndex, MinIndex, NumVertices, StartIndex, PrimitiveCount);
}
bool bCompare(const BYTE* pData, const BYTE* bMask, const char* szMask)
{
for(;*szMask;++szMask,++pData,++bMask)
if(*szMask=='x' && *pData!=*bMask) return 0;
return (*szMask) == NULL;
}
DWORD FindPattern(DWORD dwAddress,DWORD dwLen,BYTE *bMask,char * szMask)
{
for(DWORD i=0; i<dwLen; i++)
if (bCompare((BYTE*)(dwAddress+i),bMask,szMask)) return (DWORD)(dwAddress+i);
return 0;
}
void *DetourCreate(BYTE *src, const BYTE *dst, const int len)
{
BYTE *jmp = (BYTE*)malloc(len+5);
DWORD dwBack;
VirtualProtect(src, len, PAGE_EXECUTE_READWRITE, &dwBack);
memcpy(jmp, src, len);
jmp += len;
jmp[0] = 0xE9;
*(DWORD*)(jmp+1) = (DWORD)(src+len - jmp) - 5;
src[0] = 0xE9;
*(DWORD*)(src+1) = (DWORD)(dst - src) - 5;
for (int i=5; i<len; i++) src[i]=0x90;
VirtualProtect(src, len, dwBack, &dwBack);
return (jmp-len);
}
void hack()
{
DWORD D3D9, adr, *VTable;
do
{
D3D9 = (DWORD)GetModuleHandle("d3d9.dll");
Sleep(100);
} while (D3D9 == NULL);
adr = FindPattern(hD3D, 0x128000, (PBYTE)"\xC7\x06\x00\x00\x00\x00\x89\x86\x00\x00\x00\x00\x89\x86", "xx????xx????xx");
if (adr) {
memcpy(&VTable,(void *)(adr+2),4);
pDrawIndexedPrimitive = (DrawIndexedPrimitive_)DetourCreate((PBYTE)VTable[82], (PBYTE)nDrawIndexedPrimitive, 5);
}
while (1)
{
if (GetAsyncKeyState(VK_F2))
{
ghost = !ghost;
Beep(400, 100 + 100 * ghost);
}
Sleep(100);
}
}
BOOL WINAPI DllMain( HANDLE hDll, DWORD dwReason, LPVOID lpReserved )
{
DisableThreadLibraryCalls(hDll);
if (dwReason == DLL_PROCESS_ATTACH)
{
CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)hack, NULL, NULL, NULL);
}
return TRUE;
}