Making Chams for Warface + Source

Hey guys,
today we will learn how to make simple chams for Warface.
This method can be extended to make an ESP or aimbot but I will only cover Chams in this tutorial.
So lets start:

Step 1:
Requirements:
First you need Visual Studio. I recommend VS 2015.
After the installation has finished please download and install the DirectX SDK ( https://www.microsof*****m/en-us/down...s.aspx?id=6812 )
and Detours 1.5 (in the end of the topic is download).

Step 2:
Setting up your Project:
Open up a new project:
https://i.imgur.com/jpeiy2O.png

On the top of VS make sure that the project is set to "Release" and "x86":
https://i.imgur.com/3etBQcI.png

Right click on your project in the Solution Explorer:
https://i.imgur.com/v7aBvQY.png

Select "Properties". You should get this page:
https://i.imgur.com/5ujxms4.png

Change "Cofiguration Type" to "Dynamic Library (.dll)":
https://i.imgur.com/Ct5WFgQ.png

Then open "Linker" under "Configuration Properties" and then click on "Advanced" and scroll down as far as possible. It should look like this:
https://i.imgur.com/kme7bu6.png

When you are there look at the very last entry at the bottom. It says "Image Has Safe Exception Handlers". Change it to "No (/SAFESEH:NO)". Now it looks like this:
https://i.imgur.com/j0JxzKW.png

Remember to press "Apply".

After you pressed apply go to "VC++ Directories" above "Linker". It should look like this:
https://i.imgur.com/HKxokiI.png

Go to "Include Directories", click on the little arrow and then on "<Edit...>":
https://i.imgur.com/HdjlVZH.png

Now it should look like this:
https://i.imgur.com/HQv1pK2.png

Click on that little folder on the top left and then on the three points.

Now navigate to the folder you installed the DirectX SDK in. In that folder select the "Includes" folder and click "Select Folder":
https://i.imgur.com/NU3qnrj.png

Now hit that little folder again and the three points too.
This time you navigate to the path where you installed detours and select the "inc" folder:
https://i.imgur.com/r0hfr1r.png

Press "Okay" and then hit "Apply" in the bottom right corner.

Now go to "Library Directories", click on the little arrow again and then then on edit.
Click on the little folder on the top left and then the three dots again.
This time navigate to the folder in which you installed the DirectX SDK again but in it go to the folder named "Lib" and in there select the "x86" folder:
https://i.imgur.com/GZxf4Z4.png

Then do the same for Detours. In the detours folder select the "inc" folder:

Remember to hit "Okay" and "Apply" again.

Now close the Properties Page and look at the solution explorer again.
Right click on "Source Files" in the solution explorer and press "Add -> New Item" or press Ctrl + Shift + A:
https://i.imgur.com/1pkuoZZ.png

Select ".cpp" and call it whatever you want. I will just stick to "Source.cpp" for this tutorial since we will only have one cpp file.
Doubleclick on the newly created file in the solution explorer and you are ready to get into the coding part.

Step 3:
Creating DllMain:

We will start by creating the dll entrypoint:

Code:

BOOL WINAPI DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)
{
	if (dwReason == DLL_PROCESS_ATTACH)
	{
		
	}
	else if (dwReason == DLL_PROCESS_DETACH)
	{
		
	}
 
	return TRUE;
}

You will notice that this code will give us a shit ton of errors. Thats because we didnt include essential stuff.
So lets do that. Go to the very top of the script and add the following:

Code:

#include "Windows.h"
#include "intrin.h"
#include "d3d9.h"
#include "d3dx9.h"
#include "Detours.h"

There we inlude Detours, DirectX SDK, intrin for the ReturnAddress and the Windows header for almost everything.
Now lets also link to the librarys of detours and DirectX:

Code:

#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "d3dx9.lib")
#pragma comment(lib, "Detours.lib")

And while we are adding this stuff we can also add

Code:

#pragma intrinsic(_ReturnAddress)

so we can get the return addresses of the process we are in.

So now we have that lets go back to our DllMain function.
Now we want to add what happens when our dll gets attached to a process.
We want to initialize or hooks so lets do that.
First we want to create a bool named "bInit" to check if we are initializing everything or if it has been done already.
Our whole code should look something like this now:

Code:

#include "Windows.h"
#include "intrin.h"
#include "d3d9.h"
#include "d3dx9.h"
#include "Detours.h"
 
#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "d3dx9.lib")
#pragma comment(lib, "Detours.lib")
 
#pragma intrinsic(_ReturnAddress)
 
bool bInit = false;
 
BOOL WINAPI DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)
{
	if (dwReason == DLL_PROCESS_ATTACH)
	{
		
	}
	else if (dwReason == DLL_PROCESS_DETACH)
	{
		
	}
 
	return TRUE;
}

Now lets go into "if (dwReason == DLL_PROCESS_ATTACH)" and add another if statement.

Code:

if (!bInit){
 
}

This checks if we are initializing everything. If not it wont do anything if yes it will do our stuff inside of the if statement.
Now lets start our hooks.

Step 4:
DirectX Hooks with Detours:

So we now can initialize our hooks. Lets start and do it
First create the hooked functions prototypes:

Code:

typedef HRESULT(WINAPI *Prototype_Present)(LPDIRECT3DDEVICE9, CONST RECT*, CONST RECT*, HWND, CONST RGNDATA*);
typedef HRESULT(WINAPI *Prototype_DrawIndexedPrimitive)(LPDIRECT3DDEVICE9, D3DPRIMITIVETYPE, INT, UINT, UINT, UINT, UINT);

Now you might ask "what is this all?" These are the prototypes for the functions from DirectX with their parameters that we will hook.
So now lets link to our newly created prototypes:

Code:

Prototype_Present Original_Present;
Prototype_DrawIndexedPrimitive Original_DrawIndexedPrimitive;

Now that we have done that we can create our Hooked functions:

Code:

HRESULT WINAPI Hooked_Present(LPDIRECT3DDEVICE9 Device, CONST RECT *pSrcRect, CONST RECT *pDestRect, HWND hDestWindow, CONST RGNDATA *pDirtyRegion);
HRESULT WINAPI Hooked_DrawIndexedPrimitive(LPDIRECT3DDEVICE9 Device, D3DPRIMITIVETYPE PrimType, INT BaseVertexIndex, UINT MinVertexIndex, UINT NumVertices, UINT startIndex, UINT primCount);

These are our function declarations for the hooked functions. You may notice that they give you a warning. Thats because we only declared them and we didnt make a definition yet.
So lets do it. Add these underneath the DllMain function:

Code:

HRESULT WINAPI Hooked_Present(LPDIRECT3DDEVICE9 Device, CONST RECT *pSrcRect, CONST RECT *pDestRect, HWND hDestWindow, CONST RGNDATA *pDirtyRegion) {
 
}
 
HRESULT WINAPI Hooked_DrawIndexedPrimitive(LPDIRECT3DDEVICE9 Device, D3DPRIMITIVETYPE PrimType, INT BaseVertexIndex, UINT MinVertexIndex, UINT NumVertices, UINT startIndex, UINT primCount) {
 
}

One thing we havent done yet is actually hooking then original functions.
Go into the if statement that we created and add the following:

Code:

Original_Present = (Prototype_Present)DetourFunction((PBYTE)GetDeviceAddress(17), (PBYTE)Hooked_Present);
Original_DrawIndexedPrimitive = (Prototype_DrawIndexedPrimitive)DetourFunction((PBYTE)GetDeviceAddress(82), (PBYTE)Hooked_DrawIndexedPrimitive);
bInit = true;

There we are using Detours to hook the functions. You will notice again that you are getting an error for "GetDeviceAddress".
Add the following above DllMain:

Code:

DWORD FindDevice(DWORD Len)
{
	DWORD dwObjBase = 0;
 
	dwObjBase = (DWORD)LoadLibrary("d3d9.dll");
	while (dwObjBase++ < dwObjBase + Len)
	{
		if ((*(WORD*)(dwObjBase + 0x00)) == 0x06C7 && (*(WORD*)(dwObjBase + 0x06)) == 0x8689 && (*(WORD*)(dwObjBase + 0x0C)) == 0x8689) {
			dwObjBase += 2; break;
		}
	}
	return(dwObjBase);
}
 
DWORD GetDeviceAddress(int VTableIndex)
{
	PDWORD VTable;
	*(DWORD*)&VTable = *(DWORD*)FindDevice(0x128000);
	return VTable[VTableIndex];
}

Now the basic sceletons of the hooks are there. But they wont work correctly because when it switches to our hooked function it doesnt return to the original
and it will most likely crash the game since we arent removing our hooks on process detach. So lets fix the crash first.
Add the following insinde of "else if (dwReason == DLL_PROCESS_DETACH)"

Code:

DetourRemove((PBYTE)Original_Present, (PBYTE)Hooked_Present);
DetourRemove((PBYTE)Original_DrawIndexedPrimitive, (PBYTE)Hooked_DrawIndexedPrimitive);

Now it wont crash but we still arent returning to the original hooked functions.
To fix that simply add the following lines at the end of our hooked functions:

Code:

return Original_Present(Device, pSrcRect, pDestRect, hDestWindow, pDirtyRegion);

Code:

return Original_DrawIndexedPrimitive(Device, PrimType, BaseVertexIndex, MinVertexIndex, NumVertices, startIndex, primCount);

There you go. The hooks are now done. Our whole code should now look something like this:

Code:

#include "Windows.h"
#include "intrin.h"
#include "d3d9.h"
#include "d3dx9.h"
#include "Detours.h"
 
#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "d3dx9.lib")
#pragma comment(lib, "Detours.lib")
 
#pragma intrinsic(_ReturnAddress)
 
bool bInit = false;
 
typedef HRESULT(WINAPI *Prototype_Present)(LPDIRECT3DDEVICE9, CONST RECT*, CONST RECT*, HWND, CONST RGNDATA*);
typedef HRESULT(WINAPI *Prototype_DrawIndexedPrimitive)(LPDIRECT3DDEVICE9, D3DPRIMITIVETYPE, INT, UINT, UINT, UINT, UINT);
 
Prototype_Present Original_Present;
Prototype_DrawIndexedPrimitive Original_DrawIndexedPrimitive;
 
HRESULT WINAPI Hooked_Present(LPDIRECT3DDEVICE9 Device, CONST RECT *pSrcRect, CONST RECT *pDestRect, HWND hDestWindow, CONST RGNDATA *pDirtyRegion);
HRESULT WINAPI Hooked_DrawIndexedPrimitive(LPDIRECT3DDEVICE9 Device, D3DPRIMITIVETYPE PrimType, INT BaseVertexIndex, UINT MinVertexIndex, UINT NumVertices, UINT startIndex, UINT primCount);
 
DWORD FindDevice(DWORD Len)
{
	DWORD dwObjBase = 0;
 
	dwObjBase = (DWORD)LoadLibrary("d3d9.dll");
	while (dwObjBase++ < dwObjBase + Len)
	{
		if ((*(WORD*)(dwObjBase + 0x00)) == 0x06C7 && (*(WORD*)(dwObjBase + 0x06)) == 0x8689 && (*(WORD*)(dwObjBase + 0x0C)) == 0x8689) {
			dwObjBase += 2; break;
		}
	}
	return(dwObjBase);
}
 
DWORD GetDeviceAddress(int VTableIndex)
{
	PDWORD VTable;
	*(DWORD*)&VTable = *(DWORD*)FindDevice(0x128000);
	return VTable[VTableIndex];
}
 
BOOL WINAPI DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)
{
	if (dwReason == DLL_PROCESS_ATTACH)
	{
		if (!bInit) {
			Original_Present = (Prototype_Present)DetourFunction((PBYTE)GetDeviceAddress(17), (PBYTE)Hooked_Present);
			Original_DrawIndexedPrimitive = (Prototype_DrawIndexedPrimitive)DetourFunction((PBYTE)GetDeviceAddress(82), (PBYTE)Hooked_DrawIndexedPrimitive);
			bInit = true;
		}
	}
	else if (dwReason == DLL_PROCESS_DETACH)
	{
		DetourRemove((PBYTE)Original_Present, (PBYTE)Hooked_Present);
		DetourRemove((PBYTE)Original_DrawIndexedPrimitive, (PBYTE)Hooked_DrawIndexedPrimitive);
	}
 
	return TRUE;
}
 
HRESULT WINAPI Hooked_Present(LPDIRECT3DDEVICE9 Device, CONST RECT *pSrcRect, CONST RECT *pDestRect, HWND hDestWindow, CONST RGNDATA *pDirtyRegion) {
 
 
 
	return Original_Present(Device, pSrcRect, pDestRect, hDestWindow, pDirtyRegion);
}
 
HRESULT WINAPI Hooked_DrawIndexedPrimitive(LPDIRECT3DDEVICE9 Device, D3DPRIMITIVETYPE PrimType, INT BaseVertexIndex, UINT MinVertexIndex, UINT NumVertices, UINT startIndex, UINT primCount) {
 
 
 
	return Original_DrawIndexedPrimitive(Device, PrimType, BaseVertexIndex, MinVertexIndex, NumVertices, startIndex, primCount);
}

Step 5:
Making the Chams:

For making Chams we first need a few Variables.
First we need the Players ReturnAddress. The current one is:

Code:

#define Player 0x1195B7A

Then we need a bool to activate and deactivate the Chams:

Code:

bool bChams = true;

and we also need a texture we want to paint the player with:

Code:

LPDIRECT3DTEXTURE9 texRed = NULL;

To create the texture we need a "GenerateTexture" function:

Code:

HRESULT GenerateTexture(LPDIRECT3DDEVICE9 pDevice, IDirect3DTexture9 **ppD3Dtex, DWORD colour32)
{
	if (FAILED(pDevice->CreateTexture(8, 8, 1, 0, D3DFMT_A4R4G4B4, D3DPOOL_MANAGED, ppD3Dtex, NULL)))
		return E_FAIL;
 
	WORD colour16 = ((WORD)((colour32 >> 28) & 0xF) << 12)
		| (WORD)(((colour32 >> 20) & 0xF) << 8)
		| (WORD)(((colour32 >> 12) & 0xF) << 4)
		| (WORD)(((colour32 >> 4) & 0xF) << 0);
 
	D3DLOCKED_RECT d3dlr;
	(*ppD3Dtex)->LockRect(0, &d3dlr, 0, 0);
	WORD *pDst16 = (WORD*)d3dlr.pBits;
 
	for (int xy = 0; xy < 8 * 8; xy++)
		*pDst16++ = colour16;
 
	(*ppD3Dtex)->UnlockRect(0);
 
	return S_OK;
}

Now inside of Hooked_Present we will add another if statement:
Code:
if (texRed == NULL) {

}
This if statement checks if the texture is empty and if it is it will generate the texture:

Code:
GenerateTexture(Device, &texRed, D3DCOLOR_ARGB(255, 255, 0, 0));
Now that we have our texture to paint the player with lets do so.
Go inside of "Hooked_DrawIndexedPrimitive" and add the following:

Code:
void* ReturnAddress = _ReturnAddress();
Then create another if statement:

Code:
if (ReturnAddress == (void*)Player && bChams) {

}
This code checks if the rendered ReturnAddress is the one from our player and if Chams are activated.

Inside that if statement we first want to disable the players z-buffer so we can see him through walls:
Code:
Device->SetRenderState(D3DRS_ZENABLE, FALSE);

Now we want to give the actual Chams to the player:

Code:
Device->SetTexture(0, texRed);

Then we call the original drawindexedprimitive to paint everything normal again:

Code:
Original_DrawIndexedPrimitive(Device, PrimType, BaseVertexIndex, MinVertexIndex, NumVertices, startIndex, primCount);

Then we want to enable the z-buffer again:

Code:
Device->SetRenderState(D3DRS_ZENABLE, TRUE);

And finally we want to paint him Red again:

Code:
Device->SetTexture(0, texRed);

Your whole code should now look similar to this:

Code:

#include "intrin.h"
#include "d3d9.h"
#include "d3dx9.h"
#include "Detours.h"
 
#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "d3dx9.lib")
#pragma comment(lib, "Detours.lib")
 
#pragma intrinsic(_ReturnAddress)
 
#define Player 0x1195B7A
bool bInit = false;
bool bChams = true;
LPDIRECT3DTEXTURE9 texRed = NULL;
 
typedef HRESULT(WINAPI *Prototype_Present)(LPDIRECT3DDEVICE9, CONST RECT*, CONST RECT*, HWND, CONST RGNDATA*);
typedef HRESULT(WINAPI *Prototype_DrawIndexedPrimitive)(LPDIRECT3DDEVICE9, D3DPRIMITIVETYPE, INT, UINT, UINT, UINT, UINT);
 
Prototype_Present Original_Present;
Prototype_DrawIndexedPrimitive Original_DrawIndexedPrimitive;
 
HRESULT WINAPI Hooked_Present(LPDIRECT3DDEVICE9 Device, CONST RECT *pSrcRect, CONST RECT *pDestRect, HWND hDestWindow, CONST RGNDATA *pDirtyRegion);
HRESULT WINAPI Hooked_DrawIndexedPrimitive(LPDIRECT3DDEVICE9 Device, D3DPRIMITIVETYPE PrimType, INT BaseVertexIndex, UINT MinVertexIndex, UINT NumVertices, UINT startIndex, UINT primCount);
 
DWORD FindDevice(DWORD Len)
{
	DWORD dwObjBase = 0;
 
	dwObjBase = (DWORD)LoadLibrary("d3d9.dll");
	while (dwObjBase++ < dwObjBase + Len)
	{
		if ((*(WORD*)(dwObjBase + 0x00)) == 0x06C7 && (*(WORD*)(dwObjBase + 0x06)) == 0x8689 && (*(WORD*)(dwObjBase + 0x0C)) == 0x8689) {
			dwObjBase += 2; break;
		}
	}
	return(dwObjBase);
}
 
DWORD GetDeviceAddress(int VTableIndex)
{
	PDWORD VTable;
	*(DWORD*)&VTable = *(DWORD*)FindDevice(0x128000);
	return VTable[VTableIndex];
}
 
HRESULT GenerateTexture(LPDIRECT3DDEVICE9 pDevice, IDirect3DTexture9 **ppD3Dtex, DWORD colour32)
{
	if (FAILED(pDevice->CreateTexture(8, 8, 1, 0, D3DFMT_A4R4G4B4, D3DPOOL_MANAGED, ppD3Dtex, NULL)))
		return E_FAIL;
 
	WORD colour16 = ((WORD)((colour32 >> 28) & 0xF) << 12)
		| (WORD)(((colour32 >> 20) & 0xF) << 8)
		| (WORD)(((colour32 >> 12) & 0xF) << 4)
		| (WORD)(((colour32 >> 4) & 0xF) << 0);
 
	D3DLOCKED_RECT d3dlr;
	(*ppD3Dtex)->LockRect(0, &d3dlr, 0, 0);
	WORD *pDst16 = (WORD*)d3dlr.pBits;
 
	for (int xy = 0; xy < 8 * 8; xy++)
		*pDst16++ = colour16;
 
	(*ppD3Dtex)->UnlockRect(0);
 
	return S_OK;
}
 
BOOL WINAPI DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)
{
	if (dwReason == DLL_PROCESS_ATTACH)
	{
		if (!bInit) {
			Original_Present = (Prototype_Present)DetourFunction((PBYTE)GetDeviceAddress(17), (PBYTE)Hooked_Present);
			Original_DrawIndexedPrimitive = (Prototype_DrawIndexedPrimitive)DetourFunction((PBYTE)GetDeviceAddress(82), (PBYTE)Hooked_DrawIndexedPrimitive);
			bInit = true;
		}
	}
	else if (dwReason == DLL_PROCESS_DETACH)
	{
		DetourRemove((PBYTE)Original_Present, (PBYTE)Hooked_Present);
		DetourRemove((PBYTE)Original_DrawIndexedPrimitive, (PBYTE)Hooked_DrawIndexedPrimitive);
	}
 
	return TRUE;
}
 
HRESULT WINAPI Hooked_Present(LPDIRECT3DDEVICE9 Device, CONST RECT *pSrcRect, CONST RECT *pDestRect, HWND hDestWindow, CONST RGNDATA *pDirtyRegion) {
 
	if (texRed == NULL) {
		GenerateTexture(Device, &texRed, D3DCOLOR_ARGB(255, 255, 0, 0));
	}
 
	return Original_Present(Device, pSrcRect, pDestRect, hDestWindow, pDirtyRegion);
}
 
HRESULT WINAPI Hooked_DrawIndexedPrimitive(LPDIRECT3DDEVICE9 Device, D3DPRIMITIVETYPE PrimType, INT BaseVertexIndex, UINT MinVertexIndex, UINT NumVertices, UINT startIndex, UINT primCount) {
 
	void* ReturnAddress = _ReturnAddress();
 
	if (ReturnAddress == (void*)Player && bChams) {
		Device->SetRenderState(D3DRS_ZENABLE, FALSE);
		Device->SetTexture(0, texRed);
		Original_DrawIndexedPrimitive(Device, PrimType, BaseVertexIndex, MinVertexIndex, NumVertices, startIndex, primCount);
		Device->SetRenderState(D3DRS_ZENABLE, TRUE);
		Device->SetTexture(0, texRed);
	}
 
	return Original_DrawIndexedPrimitive(Device, PrimType, BaseVertexIndex, MinVertexIndex, NumVertices, startIndex, primCount);
}

Step 6:
Testing the Hack:

Now that averything is done you can save your project and hit F5 to compile it.
If it doesnt compile make sure that you did everything right.
Grab your favorite injector, add the dll that is located in the folder your project is saved in and then in "Release"
Inject it when the Warface menu has fully loaded and have fun
Credits: Dark1027

Making Chams for Warface + Source

Post a Reply

Similar Threads

Tags for this Thread