helldrg

push eax
  mov eax,[ecx+10]
  mov eax,[eax+8]
  cmp eax,'play'
  jne code
  //mov dword ptr [ecx+00000134],(float)100
  jmp code
code:
  pop eax

newmem:
  push eax
  mov eax,[ecx+10]
  cmp dword ptr[eax+8],'play'
  jne code
  mov dword ptr [ecx+00000134],(float)100
  jmp code
code:
  pop eax
  fld dword ptr [ecx+00000134]
  jmp return
INJECT:
  jmp newmem
  nop

BYTE *bytes = new BYTE[20];
            DWORD jmpAddress = allocAddress - (baseAddress + offsetAddress[2]) - 5;
            BYTE *b = new BYTE[4];
            memcpy((void*)b, &jmpAddress, 4);
            bytes[0] = '\xe9';
            bytes[1] = b[0];
            bytes[2] = b[1];
            bytes[3] = b[2];
            bytes[4] = b[3];
            bytes[5] = '\x90';
            bytes[6] = '\x90';
            if (Process.WriteMemory(baseAddress + offsetAddress[2], (LPVOID)bytes, 7) == FALSE)
                wsprintf(buffer, "Ошибка!");
            jmpAddress = (baseAddress + offsetAddress[2]) - allocAddress - 19 + 7;
            memcpy((void*)b, &jmpAddress, 4);
            bytes[0] = '\xc7';
            bytes[1] = '\x46';
            bytes[2] = '\xc8';
            bytes[3] = '\x00';
            bytes[4] = '\x00';
            bytes[5] = '\x16';
            bytes[6] = '\x44';
            bytes[7] = '\xd9';
            bytes[8] = '\x46';
            bytes[9] = '\xc8';
            bytes[10] = '\x8a';
            bytes[11] = '\x5c';
            bytes[12] = '\x24';
            bytes[13] = '\x17';
            bytes[14] = '\xe9';
            bytes[15] = b[0];
            bytes[16] = b[1];
            bytes[17] = b[2];
            bytes[18] = b[3];
            if (Process.WriteMemory(allocAddress, (LPVOID)bytes, 19) == FALSE)
                wsprintf(buffer, "Ошибка!");

void* DetourCreate(BYTE *src, const BYTE *dst, const int len)
{
	BYTE *jmp;
	DWORD dwback, dwold;
	DWORD jumpto, newjump;
	VirtualProtect(src, len, PAGE_EXECUTE_READWRITE, &dwback);
	if (src[0] == 0xE9)
	{
		jmp = (PBYTE)malloc(10);
		VirtualProtect(jmp, 10, PAGE_EXECUTE_READWRITE, &dwold);
		jumpto = (*(DWORD*)(src + 1)) + ((DWORD)src) + 5;
		newjump = (jumpto - (DWORD)(jmp + 5));
		jmp[0] = 0xE9;
		*(DWORD*)(jmp + 1) = newjump;
		jmp += 5;
		jmp[0] = 0xE9;
		*(DWORD*)(jmp + 1) = (DWORD)(src - jmp);
	}
	else
	{
		jmp = (PBYTE)malloc(5 + len);
		VirtualProtect(jmp, 5 + len, PAGE_EXECUTE_READWRITE, &dwold);
		memcpy(jmp, src, len);
		jmp += len;
		jmp[0] = 0xE9;
		*(DWORD*)(jmp + 1) = (DWORD)(src + len - jmp) - 5;
	}
	src[0] = 0xE9;
	*(DWORD*)(src + 1) = (DWORD)(dst - src) - 5;
	for (int i = 5; i < len; i++)
		src[i] = 0x90;
	VirtualProtect(src, len, dwback, &dwback);
	return (jmp - len);
}

#include <Windows.h>
#include "Include\d3d9.h"
#include "Include\d3dx9.h"
#include <io.h>
#include <stdio.h>

#pragma comment(lib, "d3d9.lib")

typedef IDirect3D9* (STDMETHODCALLTYPE *DIRECT3DCREATE9)(UINT);
typedef HRESULT(WINAPI* tPresent)(LPDIRECT3DDEVICE9 pDevice, CONST RECT*, CONST RECT*, HWND, LPVOID);
typedef HRESULT(WINAPI* tReset)(LPDIRECT3DDEVICE9 pDevice, D3DPRESENT_PARAMETERS* pPresentationParameters);
typedef DWORD(STDMETHODCALLTYPE *GETPROCESSHEAPS)(DWORD, PHANDLE);

static DWORD vtableFrag9[] = { 0, 0, 0, 0 };
static DWORD* presentPtr = 0;
static DWORD* resetPtr = 0;
static DWORD offsetPresent = 0;
static DWORD offsetReset = 0;
static tPresent g_D3D9_Present = 0;
static tReset g_D3D9_Reset = 0;
LPDIRECT3DDEVICE9 npDevice;

bool indicator = 0;

//DWORD*vtbl = 0;
//DWORD table;
//
//BOOL bCompare(const BYTE* pData, const BYTE* bMask, const char* szMask)
//{
//	for (; *szMask; ++szMask, ++pData, ++bMask)
//		if (*szMask == 'x' && *pData != *bMask)
//			return false;
//	return (*szMask) == NULL;
//}
//DWORD FindPattern(DWORD dwAddress, DWORD dwLen, BYTE *bMask, char * szMask)
//{
//	for (DWORD i = 0; i < dwLen; i++)
//		if (bCompare((BYTE*)(dwAddress + i), bMask, szMask))
//			return (DWORD)(dwAddress + i);
//
//	return 0;
//}

void CreateConsole()
{
	int hConHandle = 0;
	HANDLE lStdHandle = 0;
	FILE *fp;
	AllocConsole();
	SetConsoleTitle("Generals console!");
	lStdHandle = GetStdHandle(STD_OUTPUT_HANDLE);
	hConHandle = _open_osfhandle(PtrToUlong(lStdHandle), 0);
	fp = _fdopen(hConHandle, "w");
	*stdout = *fp;
	setvbuf(stdout, NULL, _IONBF, 0);
}


void DrawIndicator(LPVOID self)
{
	IDirect3DDevice9* dev = (IDirect3DDevice9*)self;
	dev->BeginScene();
	D3DRECT rec = { 10, 10, 30, 30 };
	D3DCOLOR color = 0;
	if (indicator)
	{
		color = D3DCOLOR_XRGB(0, 255, 0);
	}
	else
	{
		color = D3DCOLOR_XRGB(255, 0, 0);
	}
	dev->Clear(1, &rec, D3DCLEAR_TARGET, color, 1.0f, 0);
	dev->EndScene();
}

HRESULT WINAPI hkPresent(LPDIRECT3DDEVICE9 pDevice, CONST RECT* src, CONST RECT* dest, HWND hWnd, LPVOID unused)
{
	while (!npDevice)
	{
		npDevice = pDevice;
	}
	DrawIndicator(pDevice);
	return g_D3D9_Present(pDevice, src, dest, hWnd, unused);
}

HRESULT WINAPI hkReset(LPDIRECT3DDEVICE9 pDevice, D3DPRESENT_PARAMETERS* pPresentationParameters)
{
	return g_D3D9_Reset(pDevice, pPresentationParameters);
}

BOOL SearchHeap(HANDLE heap)
{
	int vtableLenBytes = sizeof(DWORD) * 4;
	PROCESS_HEAP_ENTRY mem;
	mem.lpData = 0;
	while (HeapWalk(heap, &mem))
	{
		if (mem.wFlags == PROCESS_HEAP_UNCOMMITTED_RANGE) continue;
		DWORD* p = (DWORD*)mem.lpData;
		for (int i = 0; i < (int)(mem.cbData / sizeof(DWORD)); i++)
		{
			if (memcmp(p, vtableFrag9, vtableLenBytes) == 0)
			{
				presentPtr = p + 11;
				resetPtr = p + 10;
				offsetPresent = *presentPtr;
				offsetReset = *resetPtr;
				g_D3D9_Present = (tPresent)((DWORD*)offsetPresent);
				g_D3D9_Reset = (tReset)((DWORD*)offsetReset);
				break;
			}
			p++;
		}
		if (presentPtr != 0) break;
	}
	return(presentPtr != 0);
}

void CheckAndHookPresent9()
{
	if (presentPtr != 0 && (*presentPtr) == (DWORD)hkPresent) return;
	HANDLE heap = 0;
	HMODULE hKern = GetModuleHandleA("kernel32.dll");
	GETPROCESSHEAPS getProcessHeaps = (GETPROCESSHEAPS)GetProcAddress(hKern, "GetProcessHeaps");
	if (getProcessHeaps != 0)
	{
		HANDLE heaps[1000];
		int numHeaps = (getProcessHeaps)(1000, heaps);
		for (int k = 0; k < numHeaps; k++)
		{
			heap = heaps[k];
			if (SearchHeap(heap)) break;
		}
	}
	else
	{
		heap = GetProcessHeap();
		SearchHeap(heap);
	}
	HeapLock(heap);
	if (presentPtr != 0)
	{
		(*presentPtr) = (DWORD)hkPresent;
	}
	if (resetPtr != 0)
	{
		(*resetPtr) = (DWORD)hkReset;
	}
	HeapUnlock(heap);
}

void CopyVMT9(DWORD* vtableFrag)
{
	HWND hWnd = CreateWindowA("STATIC", "dummy", 0, 0, 0, 0, 0, 0, 0, 0, 0);
	HMODULE hD3D9 = GetModuleHandleA("d3d9");
	//DIRECT3DCREATE9 Direct3DCreate9 = (DIRECT3DCREATE9)GetProcAddress(hD3D9, "Direct3DCreate9"); lib add
	IDirect3D9* d3d = Direct3DCreate9(D3D_SDK_VERSION);
	D3DDISPLAYMODE d3ddm;
	d3d->GetAdapterDisplayMode(D3DADAPTER_DEFAULT, &d3ddm);
	D3DPRESENT_PARAMETERS d3dpp;
	ZeroMemory(&d3dpp, sizeof(d3dpp));
	d3dpp.Windowed = 1;
	d3dpp.SwapEffect = D3DSWAPEFFECT_DISCARD;
	IDirect3DDevice9* d3dDevicee = 0;
	d3d->CreateDevice(0, D3DDEVTYPE_HAL, hWnd, D3DCREATE_SOFTWARE_VERTEXPROCESSING, &d3dpp, &d3dDevicee);

	DWORD* vtablePtr = (DWORD*)(*((DWORD*)d3dDevicee));
	for (int i = 0; i < 4; i++)
	{
		vtableFrag[i] = vtablePtr[i + 6]; //6ad21c70  6acdb5a0  6adaf540  6ad20760
		
	}
	d3dDevicee->Release();
	d3d->Release();
	DestroyWindow(hWnd);
}

PBYTE HookVTableFunction(PDWORD* dwVTable, PBYTE dwHook, INT Index)
{
	DWORD dwOld = 0;
	VirtualProtect((void*)((*dwVTable) + (Index * 4)), 4, PAGE_EXECUTE_READWRITE, &dwOld);

	PBYTE pOrig = ((PBYTE)(*dwVTable)[Index]);
	(*dwVTable)[Index] = (DWORD)dwHook;

	VirtualProtect((void*)((*dwVTable) + (Index * 4)), 4, dwOld, &dwOld);
	return pOrig;
}

bool hooked = 0;
DWORD WINAPI TF(LPVOID lpParam)
{
	CopyVMT9(vtableFrag9);
	CheckAndHookPresent9();
	//DWORD hhD3D9 = (DWORD)LoadLibraryA("d3d9.dll");
	//table = FindPattern(hhD3D9, 0x128000, (PBYTE)"\xC7\x06\x00\x00\x00\x00\x89\x86\x00\x00\x00\x00\x89\x86", "xx????xx????xx");
	//memcpy(&vtbl, (void*)(table + 2), 4);
	//

	while (!npDevice && !hooked)
	{
		Sleep(50);
	}
	hooked = !hooked;
	
	printf("npDevice: %x, g_D3D9_Present: %x, g_D3D9_Reset: %x\n",(DWORD*)npDevice, g_D3D9_Present, g_D3D9_Reset);
	//printf("npDevice: %x, g_D3D9_Present: %x, g_D3D9_Reset: %x\n", (DWORD*)table, vtbl[17], vtbl[16]);
	while (1)
	{
		Sleep(1000);
		//printf("npDevice: %x, g_D3D9_Present: %x, g_D3D9_Reset: %x\n", (DWORD*)npDevice, g_D3D9_Present, g_D3D9_Reset);
		HookVTableFunction((PDWORD*)npDevice, (PBYTE)hkReset, 16);
		HookVTableFunction((PDWORD*)npDevice, (PBYTE)hkPresent, 17);
	}
	return 0;
}

DWORD WINAPI KeyboardHook(LPVOID lpParam)
{
	while (1)
	{
		if (GetAsyncKeyState(VK_F1))
		{
			indicator = !indicator;
			Beep(500, 200);
		}
		Sleep(100);
	}
	return 0;
}

BOOL APIENTRY DllMain(HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved)
{
	switch (ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
	{
		CreateConsole();
		CreateThread(0, 0, &TF, 0, 0, 0);
		CreateThread(0, 0, &KeyboardHook, 0, 0, 0);
	}
	case DLL_PROCESS_DETACH:
		break;
	}
	return 1;
}