Hack no menu with chams

Hi guys i need help to create my no menu hack with chams

The detour code is this :

Code:

#ifndef _CDETOURS_H
#define _CDETOURS_H

void *DetourFunc(BYTE *src, const BYTE *dst, const int len)
{
BYTE *jmp = (BYTE*)malloc(len+5);
DWORD dwback;

VirtualProtect(src, len, PAGE_READWRITE, &dwback);

memcpy(jmp, src, len); jmp += len;

jmp[0] = 0xE9;
*(DWORD*)(jmp+1) = (DWORD)(src+len - jmp) - 5;

src[0] = 0xE9;
*(DWORD*)(src+1) = (DWORD)(dst - src) - 5;

VirtualProtect(src, len, dwback, &dwback);

return (jmp-len);
}

#endif

Then the code of the base hack is this :

Code:

#include <windows.h>
#include <stdio.h>
#include <d3d9.h>
#include <d3dx9.h>
#include <fstream>
#include "detour.h"
int chams=1;
int chamsm=1;
int nofog=1;
int cross=1;


#define D3DparamX		, UINT paramx
#define D3DparamvalX	, paramx

#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "D3DX9.LIB")



LPDIRECT3DDEVICE9 pDevice = 0;
UINT OffsetInBytes;
UINT m_Stride;


PVOID D3Ddiscover(void *tbl, int size)
{
	HWND				  hWnd;
	void				  *pInterface=0 ;
	D3DPRESENT_PARAMETERS d3dpp; 

	if ((hWnd=CreateWindowExA(NULL,WC_DIALOG,"",WS_OVERLAPPED,0,0,50,50,NULL,NULL,NULL,NULL))==NULL) return 0;
	ShowWindow(hWnd, SW_HIDE);

	LPDIRECT3D9			pD3D;
	LPDIRECT3DDEVICE9	pD3Ddev;
	if ((pD3D = Direct3DCreate9(D3D_SDK_VERSION))!=NULL) 

	{
	    ZeroMemory(&d3dpp, sizeof(d3dpp));
	    d3dpp.Windowed         = TRUE;
		d3dpp.SwapEffect       = D3DSWAPEFFECT_DISCARD;
	    d3dpp.hDeviceWindow    = hWnd;
	    d3dpp.BackBufferFormat = D3DFMT_X8R8G8B8;
	    d3dpp.BackBufferWidth  = d3dpp.BackBufferHeight = 600;
		pD3D->CreateDevice(D3DADAPTER_DEFAULT,D3DDEVTYPE_HAL,hWnd,D3DCREATE_SOFTWARE_VERTEXPROCESSING,&d3dpp,&pD3Ddev);
		if (pD3Ddev)  {
		    pInterface = (PDWORD)*(DWORD *)pD3Ddev;
			memcpy(tbl,(void *)pInterface,size);
			pD3Ddev->Release();
		}
		pD3D->Release();
	}
	DestroyWindow(hWnd);
	return pInterface;
}

void EraseHeaders(HINSTANCE hModule)
{
	/* 
	* just a func to erase headers by Croner.
	* keep in mind you wont be able to load 
	* any resources after you erase headers.
	*/

	PIMAGE_DOS_HEADER pDoH; 
	PIMAGE_NT_HEADERS pNtH;
	DWORD i, ersize, protect;

	if (!hModule) return;
	
	// well just to make clear what we doing
	pDoH = (PIMAGE_DOS_HEADER)(hModule);

	pNtH = (PIMAGE_NT_HEADERS)((LONG)hModule + ((PIMAGE_DOS_HEADER)hModule)->e_lfanew);

	ersize = sizeof(IMAGE_DOS_HEADER);
	if ( VirtualProtect(pDoH, ersize, PAGE_READWRITE, &protect) )
	{
		for ( i=0; i < ersize; i++ )
				*(BYTE*)((BYTE*)pDoH + i) = 0;
	}

	ersize = sizeof(IMAGE_NT_HEADERS);
	if ( pNtH && VirtualProtect(pNtH, ersize, PAGE_READWRITE, &protect) )
	{
		for ( i=0; i < ersize; i++ )
				*(BYTE*)((BYTE*)pNtH + i) = 0;
	}
	return;
}

typedef HRESULT (WINAPI* oDrawIndexedPrimitive) (LPDIRECT3DDEVICE9 pDevice, D3DPRIMITIVETYPE Type, INT BaseVertexIndex, UINT MinVertexIndex, UINT NumVertices, UINT startIndex, UINT primCount);
oDrawIndexedPrimitive pDrawIndexedPrimitive;

HRESULT WINAPI  myDrawIndexedPrimitive(LPDIRECT3DDEVICE9 pDevice, D3DPRIMITIVETYPE pType D3DparamX ,UINT nMinIndex, UINT nNumVertices, UINT nStartIndex, UINT nPrimitiveCount )
{
	_asm pushad;

  LPDIRECT3DVERTEXBUFFER9 Stream_Data;
  UINT Offset = 0;
  UINT Stride = 0;

  if(pDevice->GetStreamSource(0, &Stream_Data, &Offset, &Stride) == D3D_OK)
  Stream_Data->Release();

  if(Stride==36 && chams)
		{
		pDevice->SetRenderState(D3DRS_ZENABLE,false);
		if(chams==1)pDevice->SetRenderState(D3DRS_AMBIENT, D3DCOLOR_ARGB(255,255,0,0));
		pDrawIndexedPrimitive(pDevice,pType D3DparamvalX,nMinIndex,nNumVertices,nStartIndex,nPrimitiveCount);
		pDevice->SetRenderState(D3DRS_ZENABLE,true);
        if(chamsm==1)pDevice->SetRenderState(D3DRS_AMBIENT, D3DCOLOR_ARGB(255,0,0,255));
		
	}

if(nofog==1)
  {
	  pDevice->SetRenderState(D3DRS_FOGENABLE, false);
  }

if(cross==1){
int x = ( GetSystemMetrics( 0 ) / 2); 
int y = ( GetSystemMetrics( 1 ) / 2); 
D3DRECT rec = { x - 10, y, x + 10, y + 1};
D3DRECT rec2 = { x, y - 10, x + 1, y + 10}; 
pDevice->Clear(1, &rec, D3DCLEAR_TARGET, D3DCOLOR_ARGB(255,0,0,255), 0, 0);
pDevice->Clear(1, &rec2, D3DCLEAR_TARGET, D3DCOLOR_ARGB(255,0,0,255), 0, 0);}


	_asm popad;
    return pDrawIndexedPrimitive(pDevice,pType D3DparamvalX,nMinIndex,nNumVertices,nStartIndex,nPrimitiveCount);
}




void HideModule(HINSTANCE hModule)
{
	DWORD dwPEB_LDR_DATA = 0;
	_asm
	{
		pushad;
		pushfd;
		mov eax, fs:[30h]             
		mov eax, [eax+0Ch]               
		mov dwPEB_LDR_DATA, eax	

		InLoadOrderModuleList:
			mov esi, [eax+0Ch]	     
			mov edx, [eax+10h]	     

		LoopInLoadOrderModuleList: 
		    lodsd		         
			mov esi, eax	
			mov ecx, [eax+18h]  
			cmp ecx, hModule	
			jne SkipA		 
		    mov ebx, [eax]	  
		    mov ecx, [eax+4]  
		    mov [ecx], ebx    
		    mov [ebx+4], ecx	  
			jmp InMemoryOrderModuleList 

		SkipA:
			cmp edx, esi     
			jne LoopInLoadOrderModuleList

		InMemoryOrderModuleList:
			mov eax, dwPEB_LDR_DATA
			mov esi, [eax+14h]
			mov edx, [eax+18h]

		LoopInMemoryOrderModuleList: 
			lodsd
			mov esi, eax
			mov ecx, [eax+10h]
			cmp ecx, hModule
			jne SkipB
			mov ebx, [eax] 
			mov ecx, [eax+4]
			mov [ecx], ebx
			mov [ebx+4], ecx
			jmp InInitializationOrderModuleList

		SkipB:
			cmp edx, esi
			jne LoopInMemoryOrderModuleList

		InInitializationOrderModuleList:
			mov eax, dwPEB_LDR_DATA
			mov esi, [eax+1Ch]	  
			mov edx, [eax+20h]	  

		LoopInInitializationOrderModuleList: 
			lodsd
			mov esi, eax		
			mov ecx, [eax+08h]
			cmp ecx, hModule		
			jne SkipC
			mov ebx, [eax] 
			mov ecx, [eax+4]
			mov [ecx], ebx
			mov [ebx+4], ecx
			jmp Finished

		SkipC:
			cmp edx, esi
			jne LoopInInitializationOrderModuleList

		Finished:
			popfd;
			popad;
	}
}





int D3D(void)
{
	HINSTANCE	hD3D;
	DWORD		vTable[105];
	hD3D=0;
	do {
		hD3D = GetModuleHandleA("d3d9.dll");
		if (!hD3D) Sleep(10);
	} while(!hD3D);



	if (D3Ddiscover((void *)&vTable[0],420)==0) return 0;
	{
		
		while(1)
		{
		if(memcmp((void*)vTable[82],(void*)(PBYTE)"\x8B\xFF",2)== 0)

		{
			/*as soon as u add ur detour uncomment this :D also if u really need the detours why dont donate ****** to get em ?*/ 
	     //pDrawIndexedPrimitive = (oDrawIndexedPrimitive) memcmp((void*)vTable[82], (void*)myDrawIndexedPrimitive,12);
		}
		
		Sleep(100);
	}

	return 0;
}	

}


BOOL WINAPI DllMain(HMODULE hDll, DWORD dwReason, LPVOID lpReserved)
{
	if (dwReason == DLL_PROCESS_ATTACH) 
	{
			HideModule(hDll);
			EraseHeaders(hDll);

	    CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)D3D, NULL, NULL, NULL);
			 
	}
	return TRUE;
}

Can i improve this code "pDrawIndexedPrimitive = (oDrawIndexedPrimitive) memcmp((void*)vTable[82], (void*)myDrawIndexedPrimitive,12);" ? If yes How ??

Help Please !

I get this errors:

Code:

1>------ Build started: Project: Kip3300 no-menu chams!, Configuration: Debug Win32 ------
1>Compiling...
1>Base.cpp
1>c:\users\jelle\documents\visual studio 2008\projects\kip3300 no-menu chams!\kip3300 no-menu chams!\base.cpp(32) : error C2664: 'CreateWindowExW' : cannot convert parameter 3 from 'const char [1]' to 'LPCWSTR'
1>        Types pointed to are unrelated; conversion requires reinterpret_cast, C-style cast or function-style cast
1>c:\users\jelle\documents\visual studio 2008\projects\kip3300 no-menu chams!\kip3300 no-menu chams!\base.cpp(227) : error C2664: 'GetModuleHandleW' : cannot convert parameter 1 from 'const char [9]' to 'LPCWSTR'
1>        Types pointed to are unrelated; conversion requires reinterpret_cast, C-style cast or function-style cast
1>Build log was saved at "file://c:\Users\Jelle\Documents\Visual Studio 2008\Projects\Kip3300 no-menu chams!\Kip3300 no-menu chams!\Debug\BuildLog.htm"
1>Kip3300 no-menu chams! - 2 error(s), 0 warning(s)
========== Build: 0 succeeded, 1 failed, 0 up-to-date, 0 skipped ==========

Hack no menu with chams

Post a Reply

Tags for this Thread