CA D3D VMT Hook with HS bypass

DWORD GetAddressPtr(int index)
{
    DWORD dwBase = *(DWORD*)dwDevicePointer;
    if(dwBase == 0) return 0;

    dwBase = *(DWORD*)dwBase;
    if(dwBase == 0) return 0;

    dwBase = *(DWORD*)dwBase;
    if(dwBase == 0) return 0;

    return dwBase+4*index;
}

DWORD GetD3DHSApi(int index)
{
    DWORD dwVA = dwHSDevicePointer;

    if(IsBadReadPtr((void*)dwVA, 4)) return 0;
    
    dwVA = *(DWORD*)dwVA;
    
    if(!dwVA || IsBadReadPtr((void*)dwVA, 0x200)) return 0;
    
    return dwVA + (4*index);
}

#define HOOKD3DAPI(a, b) \
    if(*(DWORD*)GetAddressPtr(b) != (DWORD)&hk##a) { \
        p##a = (a##_t) *(DWORD*)GetAddressPtr(b); \
        *(DWORD*)GetAddressPtr(b) = (DWORD)&hk##a; \
        *(DWORD*)GetD3DHSApi(b) = (DWORD)&hk##a; \
    }


DWORD WINAPI HookD3DApis(LPVOID)
{
    bool bValid = false;
    while(true) {
        bValid = GetAddressPtr(0) > 0;

        if(bValid) {
            HOOKD3DAPI(Reset, 16)
            HOOKD3DAPI(EndScene, 42)
            HOOKD3DAPI(DrawIndexedPrimitive, 82)
            HOOKD3DAPI(SetStreamSource, 100)
        }
        
        Sleep(300);
    }

    return 1;
}

dwHSDevicePointer = g_pTools->dwFindPattern((DWORD)GetModuleHandle(ehsvc), 0x90000, (PBYTE)"\x8B\x84\x11\x00\x00\x00\x00\x8B\x8D\xCC\xFD\xFF\xFF\x8B\x95", "xxx????xxxxxxxx");
    if(dwHSDevicePointer) {
        dwHSDevicePointer = *(DWORD*)(dwHSDevicePointer+3);
        dwHSDevicePointer += 0x10;
    }

DWORD dwTempDevicePointer = g_pTools->dwFindPattern((DWORD)GetModuleHandle(0), (DWORD)0xFFFFFFFF, (PBYTE)"\xA1\x00\x00\x00\x00\x89\x45\xF8\x8D", "x????xxxx");
    if(dwTempDevicePointer) {
        dwDevicePointer = *(DWORD*)(dwTempDevicePointer+1);
    }