Simple Chams [Source]

[LeHaxzor]

This is the latest request.
A simple chams with pink in it.
I also included a much better endscene.
Enjoy.

Credits: So many places...
I typed every bit of it...
Just had a lot of projects I was able to look at, chose what I needed..
Trial and error.

You're more than welcome to change the color and logo to your own I don't give a crap, have fun with it.
I can make a really simple menu out of this, or a more complex one, would anyone like a tutorial?

#pragma comment (lib, "d3dx9.lib")
#pragma comment (lib, "d3d9.lib")

#include <Windows.h>
#include "Colors.h"
#include <d3d9.h>
#include <d3dx9.h>
#include <iostream>
#include <fstream>
#include <detours.h>
#include <stdio.h>
#include <vector>
#include "d3d9types.h"

using namespace std;
bool Generated = false;

//Chams
#pragma intrinsic(_ReturnAddress)
#define Player_ReturnAddress 0x615CCB
//Chams

#define HOOK(func,addy)	o##func = (t##func)DetourFunction((PBYTE)addy,(PBYTE)hk##func)
#define D3D_RELEASE(D3D_PTR) if( D3D_PTR ){ D3D_PTR->Release(); D3D_PTR = NULL; }
#define ES	0
#define DIP	1
#define RES 2

DWORD VTable[3] = { 0 };
DWORD WINAPI FindWin(LPVOID);
DWORD D3DEndScene;
DWORD D3DReset;
DWORD D3DDrawIndexedPrimitive;
DWORD WINAPI VirtualMethodTableRepatchingLoopToCounterExtensionRepatching(LPVOID);
PDWORD Direct3D_VMTable = NULL;

BYTE CodeFragmentES[5] = { 0, 0, 0, 0, 0 };
BYTE CodeFragmentR[5] = { 0, 0, 0, 0, 0 };
BYTE CodeFragmentDIP[5] = { 0, 0, 0, 0, 0 };

HRESULT WINAPI Direct3DCreate9_VMTable(VOID);
HRESULT WINAPI hkReset(LPDIRECT3DDEVICE9, D3DPRESENT_PARAMETERS*);
typedef HRESULT(WINAPI* tEndScene)(LPDIRECT3DDEVICE9 LeHaxzor);
typedef HRESULT(WINAPI* DrawIndexedPrimitive_)(LPDIRECT3DDEVICE9 Device, D3DPRIMITIVETYPE Type, INT BaseVertexIndex, UINT MinIndex, UINT NumVertices, UINT StartIndex, UINT PrimitiveCount);
typedef HRESULT(WINAPI* tDrawIndexedPrimitive)(LPDIRECT3DDEVICE9 LeHaxzor, D3DPRIMITIVETYPE PrimType, INT BaseVertexIndex, UINT MinIndex, UINT NumVertices, UINT StartIndex, UINT PrimitiveCount);
typedef HRESULT(WINAPI* tReset)(LPDIRECT3DDEVICE9, D3DPRESENT_PARAMETERS*);
tReset oReset;
DrawIndexedPrimitive_ oDrawIndexedPrimitive = NULL;
tEndScene oEndScene;


//font
LPD3DXFONT	g_pFont = NULL;
//font

DWORD FindDevice(DWORD Len)
{
	DWORD dwObjBase = 0;

	dwObjBase = (DWORD)LoadLibrary("d3d9.dll");
	while (dwObjBase++ < dwObjBase + Len)
	{
		if ((*(WORD*)(dwObjBase + 0x00)) == 0x06C7
			&& (*(WORD*)(dwObjBase + 0x06)) == 0x8689
			&& (*(WORD*)(dwObjBase + 0x0C)) == 0x8689
			) {
			dwObjBase += 2; break;
		}
	}
	return(dwObjBase);
}

DWORD GetDeviceAddress(int VTableIndex)
{
	PDWORD VTable;
	*(DWORD*)&VTable = *(DWORD*)FindDevice(0x128000);
	return VTable[VTableIndex];
}

//Generate Texture for chams
LPDIRECT3DTEXTURE9 White;
LPDIRECT3DTEXTURE9 Pink;
LPDIRECT3DTEXTURE9 Black;
LPDIRECT3DTEXTURE9 Blue;
LPDIRECT3DTEXTURE9 Red;
LPDIRECT3DTEXTURE9 Yellow;
LPDIRECT3DTEXTURE9 Green;
LPDIRECT3DTEXTURE9 Purple;
LPDIRECT3DTEXTURE9 Cyan;
LPDIRECT3DTEXTURE9 Turquoise;
LPDIRECT3DTEXTURE9 Orange;
//Generate Texture for chams
//Color for menu
//Color for menu



//----------------------------------------------------------------------------------------------------//
//Drawing
void DrawShadowText(int x, int y, D3DCOLOR color, char* String)
{
	RECT Font;
	Font.bottom = 0;
	Font.left = x;
	Font.top = y;
	Font.right = 0;

	RECT Fonts;
	Fonts.bottom = 0;
	Fonts.left = x + 1;
	Fonts.top = y + 1;
	Fonts.right = 0;

	g_pFont->DrawTextA(0, String, strlen(String), &Fonts, DT_NOCLIP, 0xFF010101);
	g_pFont->DrawTextA(0, String, strlen(String), &Font, DT_NOCLIP, color);
}
void DrawString(int x, int y, D3DCOLOR color, const char *fmt, ...)
{
	RECT FontPos = { x, y, x + 120, y + 16 };
	char buf[1024] = { '\0' };
	va_list va_alist;

	va_start(va_alist, fmt);
	vsprintf_s(buf, fmt, va_alist);
	va_end(va_alist);

	g_pFont->DrawText(NULL, buf, -1, &FontPos, DT_NOCLIP, color);
}
//Drawing


//Generate Texture for chams
HRESULT GenerateTexture(LPDIRECT3DDEVICE9 LeHaxzor, IDirect3DTexture9 **ppD3Dtex, DWORD colour32)
{
	if (FAILED(LeHaxzor->CreateTexture(8, 8, 1, 0, D3DFMT_A4R4G4B4, D3DPOOL_MANAGED, ppD3Dtex, NULL)))
		return E_FAIL;

	WORD colour16 = ((WORD)((colour32 >> 28) & 0xF) << 12)
		| (WORD)(((colour32 >> 20) & 0xF) << 8)
		| (WORD)(((colour32 >> 12) & 0xF) << 4)
		| (WORD)(((colour32 >> 4) & 0xF) << 0);

	D3DLOCKED_RECT d3dlr;
	(*ppD3Dtex)->LockRect(0, &d3dlr, 0, 0);
	WORD *pDst16 = (WORD*)d3dlr.pBits;

	for (int xy = 0; xy < 8 * 8; xy++)
		*pDst16++ = colour16;

	(*ppD3Dtex)->UnlockRect(0);

	return S_OK;
}
//Generate Texture for chams

HRESULT WINAPI hkDrawIndexedPrimitive(LPDIRECT3DDEVICE9 LeHaxzor, D3DPRIMITIVETYPE PrimType, INT BaseVertexIndex, UINT MinIndex, UINT NumVertices, UINT StartIndex, UINT PrimitiveCount)
{
	//DIP

	//Chams
	void* ReturnAddress = _ReturnAddress();
	if (ReturnAddress != NULL && ReturnAddress == (void *)Player_ReturnAddress)
	{
		LeHaxzor->SetTexture(0, Pink);
		LeHaxzor->SetRenderState(D3DRS_ZENABLE, false);
		LeHaxzor->DrawIndexedPrimitive(PrimType, BaseVertexIndex, MinIndex, NumVertices, StartIndex, PrimitiveCount);
		LeHaxzor->SetRenderState(D3DRS_ZENABLE, true);
		LeHaxzor->SetTexture(0, Turquoise);
	}
	//Chams

	return oDrawIndexedPrimitive(LeHaxzor, PrimType, BaseVertexIndex, MinIndex, NumVertices, StartIndex, PrimitiveCount);
}

HRESULT WINAPI hkReset(LPDIRECT3DDEVICE9 LeHaxzor, D3DPRESENT_PARAMETERS* PresP)
{
	//Reset
	D3D_RELEASE(g_pFont);

	return oReset(LeHaxzor, PresP);
}

HRESULT WINAPI hkEndScene(LPDIRECT3DDEVICE9 LeHaxzor)
{
	if (g_pFont == NULL) D3DXCreateFont(LeHaxzor, 15, 0, FW_BOLD, 1, 0, DEFAULT_CHARSET, OUT_DEFAULT_PRECIS, ANTIALIASED_QUALITY, DEFAULT_PITCH | FF_DONTCARE, "red", &g_pFont);


		//Menu Start
		DrawShadowText(100, 100, D3DCOLOR_ARGB(255, 0, 255, 255), "LeHaxzor made this shit from scratch"); // Cyan
		//Menu End

		//Chams
		if (!Generated) {
			if (Red == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&red, sizeof(red), &Red);
			if (Orange == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&orange, sizeof(orange), &Orange);
			if (Green == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&bGreen, sizeof(bGreen), &Green);
			if (Blue == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&bBlue, sizeof(bBlue), &Blue);
			if (White == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&bWhite, sizeof(bWhite), &White);
			if (Yellow == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&bYellow, sizeof(bYellow), &Yellow);
			if (Pink == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&bPink, sizeof(bPink), &Pink);
			if (Turquoise == NULL)D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&bTur, sizeof(bTur), &Turquoise);
			if (Black == NULL)	D3DXCreateTextureFromFileInMemory(LeHaxzor, (LPCVOID)&bBlack, sizeof(bBlack), &Black);
			//Chams
			Generated = true;
		}


	return oEndScene(LeHaxzor);
}


LRESULT CALLBACK MsgProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
	return DefWindowProc(hwnd, uMsg, wParam, lParam); 
}
void DX_Init(DWORD* table)
{
	WNDCLASSEX wc = { sizeof(WNDCLASSEX), CS_CLASSDC, MsgProc, 0L, 0L, GetModuleHandle(NULL), NULL, NULL, NULL, NULL, "DX", NULL };
	RegisterClassEx(&wc);
	HWND hWnd = CreateWindow("DX", NULL, WS_OVERLAPPEDWINDOW, 100, 100, 300, 300, GetDesktopWindow(), NULL, wc.hInstance, NULL);
	LPDIRECT3D9 pD3D = Direct3DCreate9(D3D_SDK_VERSION);
	D3DPRESENT_PARAMETERS d3dpp;
	ZeroMemory(&d3dpp, sizeof(d3dpp));
	d3dpp.Windowed = TRUE;
	d3dpp.SwapEffect = D3DSWAPEFFECT_DISCARD;
	d3dpp.BackBufferFormat = D3DFMT_UNKNOWN;
	LPDIRECT3DDEVICE9 pd3dDevice;
	pD3D->CreateDevice(D3DADAPTER_DEFAULT, D3DDEVTYPE_HAL, hWnd, D3DCREATE_SOFTWARE_VERTEXPROCESSING, &d3dpp, &pd3dDevice);
	DWORD* pVTable = (DWORD*)pd3dDevice;
	pVTable = (DWORD*)pVTable[0];

	table[ES] = pVTable[42];
	table[DIP] = pVTable[82];
	table[RES] = pVTable[16];

	DestroyWindow(hWnd);
}

//Hook
DWORD WINAPI MyThread(LPVOID)
{
	while (GetModuleHandle("d3d9.dll") == NULL) {
		Sleep(250);
	}

	DX_Init(VTable);

	HOOK(EndScene, VTable[ES]);
	HOOK(DrawIndexedPrimitive, VTable[DIP]);
	HOOK(Reset, VTable[RES]);

	return 0;
}

BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpvReserved)
{
	if (dwReason == DLL_PROCESS_ATTACH) {

		CreateThread(0, 0, MyThread, 0, 0, 0);
	}

	return TRUE;
}

- - - Updated - - -

For No smoke no fog.
At top

#define Smoke 0X619DA0

In DIP

if (ReturnAddress != NULL && ReturnAddress == (void *)Smoke)
{
return D3D_OK;
}

[acidzxx]

where to paste code at?

[LeHaxzor]

Visual Studio 2015.

[Picobello]

Hi LeHaxzor,

Nice work dude.

I am a D3D hack coder myself and I have a question regarding your work:

Why do you use the return address to identify the model?
Doing so, the hack won't work every time there is an update of the game right? (compilation changes the address space and so the return address)
Why not using the models parameters instead which would make the hack surviving any upcoming update?

Thanks dude

[LeHaxzor]

Hi LeHaxzor,

Nice work dude.

I am a D3D hack coder myself and I have a question regarding your work:

Why do you use the return address to identify the model?
Doing so, the hack won't work every time there is an update of the game right? (compilation changes the address space and so the return address)
Why not using the models parameters instead which would make the hack surviving any upcoming update?

Thanks dude

I tried logging model rec and it doesn't work.. and I'm not entirely sure how to do pSizeOfData;

But do you mean something like this?

	int MyStride;
	if ((NumVertices == 128 && PrimitiveCount == 120 && MyStride == 16)) {
		LeHaxzor->SetTexture(0, Orange);
		LeHaxzor->SetRenderState(D3DRS_ZENABLE, false);
		LeHaxzor->DrawIndexedPrimitive(PrimType, BaseVertexIndex, MinIndex, NumVertices, StartIndex, PrimitiveCount);
		LeHaxzor->SetRenderState(D3DRS_ZENABLE, true);
		LeHaxzor->SetTexture(0, Turquoise);
	}

[Picobello]

But do you mean something like this?

	int MyStride;
	if ((NumVertices == 128 && PrimitiveCount == 120 && MyStride == 16)) {
		LeHaxzor->SetTexture(0, Orange);
		LeHaxzor->SetRenderState(D3DRS_ZENABLE, false);
		LeHaxzor->DrawIndexedPrimitive(PrimType, BaseVertexIndex, MinIndex, NumVertices, StartIndex, PrimitiveCount);
		LeHaxzor->SetRenderState(D3DRS_ZENABLE, true);
		LeHaxzor->SetTexture(0, Turquoise);
	}

That's right !
I believe you LeHaxzor: sometimes the models are so fragmented that it is not possible to do that way

I compiled you code.
It works great but ...
I have a little problem - Can you help me?

In windowed mode: everything is OK when I inject
In Full Screen mode: just after the injection the game is back to full screen automatically but it does not have the mouse focus. The mouse focus stays with the background apps to which I don't have access because of the game in full screen.
So I am forced to play in windowed mode.
I tried several injectors: Winject, RemoteDLL, Extreme Injector, etc -> All give that same problem

Do you have that problem in Full Screen?
Do you have a walk around this prob?

Thanks man.

[LeHaxzor]

That's right !
I believe you LeHaxzor: sometimes the models are so fragmented that it is not possible to do that way

I compiled you code.
It works great but ...
I have a little problem - Can you help me?

In windowed mode: everything is OK when I inject
In Full Screen mode: just after the injection the game is back to full screen automatically but it does not have the mouse focus. The mouse focus stays with the background apps to which I don't have access because of the game in full screen.
So I am forced to play in windowed mode.
I tried several injectors: Winject, RemoteDLL, Extreme Injector, etc -> All give that same problem

Do you have that problem in Full Screen?
Do you have a walk around this prob?

Thanks man.

Yeah, Use windowed mode...

No, I don't have that problem.