IAT hook D3D透视源码 过检测的写法

Jacqueline季

1. 
   
2. #include "stdafx.h"
   
3. #include <d3d9.h>
   
4. #include <d3dx9.h>
   
5. #pragma comment(lib, "d3d9.lib")
   
6. #pragma comment(lib, "d3dx9.lib")
   
7. bool bCompare(CONST BYTE *pData, CONST BYTE *bMask, CONST CHAR *szMask)
   
8. {
   
9.   for (; *szMask; ++szMask, ++pData, ++bMask)
   
10.   if (*szMask == 'x' && *pData != *bMask)
    
11.     return false;
    
12. 
    
13.   return (*szMask) == NULL;
    
14. }
    
15. DWORD FindPattern(DWORD dwAddress, DWORD dwLen, BYTE* bMask, char* szMask)
    
16. {
    
17.   for (DWORD i = 0; i < dwLen; i++)
    
18.   if (bCompare((BYTE *)(dwAddress + i), bMask, szMask))
    
19.     return (DWORD)(dwAddress + i);
    
20. 
    
21.   return 0;
    
22. }
    
23. 
    
24. 
    
25. 
    
26. void __cdecl nReset(void)
    
27. {
    
28.   _asm pushad
    
29. 
    
30.   _asm popad
    
31. }
    
32. static DWORD PresentRetAddr;
    
33. __declspec(naked) DWORD __stdcall Present_Return(LPDIRECT3DDEVICE9 pDevice, CONST RECT *pSourceRect, CONST RECT *pDestRect, HWND hDestWindowOverride, CONST RGNDATA *pDirtyRegion)
    
34. {
    
35. 
    
36.   __asm
    
37.   {
    
38. 
    
39.     MOV EDI, EDI
    
40.       PUSH EBP
    
41.       MOV EBP, ESP
    
42.       jmp PresentRetAddr
    
43.   }
    
44. 
    
45. }
    
46. 
    
47. static LPDIRECT3DDEVICE9 pDevice;
    
48. LPD3DXFONT pFont = 0;
    
49. #define TextRed     D3DCOLOR_ARGB(255,255,0,0)
    
50. void WriteText(LPD3DXFONT g_pFont, INT x, INT y, D3DCOLOR Color, WCHAR *String)
    
51. {
    
52.   RECT Rect;
    
53.   SetRect(&Rect, x, y, x, y);
    
54.   g_pFont->DrawText(0, String, -1, &Rect, DT_LEFT | DT_NOCLIP, Color);
    
55. }
    
56. 
    
57. //这个函数用于取当前的指针,或许有更好的办法......
    
58. HRESULT WINAPI Present_Detour(LPDIRECT3DDEVICE9 Device, CONST RECT *pSourceRect, CONST RECT *pDestRect, HWND hDestWindowOverride, CONST RGNDATA *pDirtyRegion)
    
59. {
    
60.   pDevice = Device; //这行代码执行后就可以恢复这个函数的钩子, 避免被检测//恢复的代码就自己写吧
    
61. 
    
62.   return Present_Return(Device, pSourceRect, pDestRect, hDestWindowOverride, pDirtyRegion);
    
63. 
    
64. }
    
65. 
    
66. D3DVIEWPORT9 VPort;
    
67. DWORD SCenterX, SCenterY;
    
68. WCHAR Msg[256];
    
69. void __cdecl nEndScene(void)
    
70. {
    
71.   static LPDIRECT3DDEVICE9 dwpDevice;
    
72.   static DWORD dwEBP=0,offset=0;
    
73.   __asm pushad
    
74.   __asm MOV dwEBP, EBP
    
75.   if (pDevice&&!offset)
    
76.   {//遍历堆栈,取设备当前设备指针
    
77.     for (int i = 0; i < 1024; i++)
    
78.     {
    
79.       if (*(DWORD*)(dwEBP + i) == (DWORD)pDevice)
    
80.       {
    
81.         offset = i;
    
82.         break;
    
83.       }
    
84.     }
    
85.   }
    
86.   dwpDevice = *(LPDIRECT3DDEVICE9*)(dwEBP + offset);//取出指针
    
87.   if (offset&&dwpDevice)
    
88.   {//这个判断防止空指针,避免崩溃
    
89. 
    
90. 
    
91. 
    
92.     /*
    
93.     以下就可以进行菜单绘制等操作
    
94.     */
    
95.     static bool dwIPfos = 0;
    
96.     if (pFont)
    
97.     {
    
98.       pFont->Release();
    
99.       pFont = NULL;
    
100.       dwIPfos = false;
     
101.     }
     
102.     if (!dwIPfos)
     
103.     {
     
104.       D3DXCreateFont(pDevice, 15, 0, 800, 1, 0, DEFAULT_CHARSET, OUT_DEFAULT_PRECIS, ANTIALIASED_QUALITY, DEFAULT_PITCH | FF_DONTCARE, L"Arial", &pFont);
     
105.       dwIPfos = true;
     
106.     }
     
107.     WriteText(pFont, 150, 150, TextRed, L"德玛西亚");
     
108. 
     
109.     dwpDevice->GetViewport(&VPort);
     
110.     SCenterX = (float)VPort.Width / 2;
     
111.     SCenterY = (float)VPort.Height / 2;
     
112.     D3DRECT rec01 = { SCenterX - 2, SCenterY, SCenterX + 3, SCenterY + 1 };
     
113.     D3DRECT rec02 = { SCenterX, SCenterY - 2, SCenterX + 1, SCenterY + 3 };
     
114.     dwpDevice->Clear(1, &rec01, D3DCLEAR_TARGET, TextRed, 0, 0);
     
115.     dwpDevice->Clear(1, &rec02, D3DCLEAR_TARGET, TextRed, 0, 0);
     
116.   }
     
117.   __asm popad
     
118. }
     
119. 
     
120. 
     
121. void __cdecl nDrawIndexedPrimitive(void)
     
122. {
     
123.   static LPDIRECT3DDEVICE9 dwpDevice;
     
124.   static DWORD dwEBP = 0, offset = 0;
     
125.   __asm pushad
     
126.   __asm MOV dwEBP, EBP
     
127.   if (pDevice&&!offset)
     
128.   {
     
129.     for (int i = 0; i < 1024; i++)
     
130.     {//遍历堆栈,取设备当前设备指针
     
131.       if (*(DWORD*)(dwEBP + i) == (DWORD)pDevice)
     
132.       {
     
133.         offset = i;
     
134.         break;//取到就跳出
     
135.       }
     
136. 
     
137.     }
     
138.   }
     
139.   dwpDevice = *(LPDIRECT3DDEVICE9*)(dwEBP + offset);//取出指针
     
140.   if (offset&&dwpDevice)
     
141.   {//这个判断防止空指针,避免崩溃
     
142.     LPDIRECT3DVERTEXBUFFER9   Stream = NULL;
     
143.     UINT Offset = 0;
     
144.     UINT Stride = 0;
     
145.     if (dwpDevice->GetStreamSource(0, &Stream, &Offset, &Stride) == D3D_OK)
     
146.       Stream->Release();
     
147.     if (Stride == 44 || Stride == 40){
     
148.       pDevice->SetRenderState(D3DRS_ZENABLE, FALSE);
     
149.     }
     
150.   }
     
151.   _asm popad
     
152. }
     
153. static DWORD hHooking = NULL;
     
154. static DWORD hEndScene = NULL;
     
155. static DWORD hReset = NULL;
     
156. static DWORD hDrawIndexPrimtive = NULL;
     
157. 
     
158. 
     
159. typedef void (WINAPI * EnterCriticalSection_t) (LPCRITICAL_SECTION lpCriticalSection);
     
160. EnterCriticalSection_t  pEnterCriticalSection;
     
161. 
     
162. void WINAPI nEnterCriticalSection(LPCRITICAL_SECTION lpCriticalSection)
     
163. {
     
164. 
     
165.   _asm
     
166.   {
     
167.     MOV EAX, [EBP + 0x4]
     
168.       MOV hHooking, EAX
     
169.   }
     
170. 
     
171.   // EndScene
     
172.   if (hHooking == hEndScene)
     
173.   {
     
174.     __asm call[nEndScene]
     
175.   }
     
176. 
     
177.   //Reset
     
178.   if (hHooking == hReset)
     
179.   {
     
180.     __asm call[nReset]
     
181.   }
     
182. 
     
183.   // DIP
     
184.   if (hHooking == hDrawIndexPrimtive)
     
185.   {
     
186.     __asm call[nDrawIndexedPrimitive];
     
187.   }
     
188. 
     
189. 
     
190.   return pEnterCriticalSection(lpCriticalSection);
     
191. }
     
192. void* DetourCreate(BYTE *src, CONST BYTE *dst, CONST INT len)
     
193. {
     
194.   BYTE *jmp = (BYTE*)malloc(len + 5);
     
195. 
     
196.   DWORD dwback;
     
197. 
     
198.   VirtualProtect(src, len, PAGE_READWRITE, &dwback);
     
199. 
     
200.   memcpy(jmp, src, len); jmp += len;
     
201. 
     
202.   jmp[0] = 0xE9;
     
203. 
     
204.   *(DWORD*)(jmp + 1) = (DWORD)(src + len - jmp) - 5;
     
205. 
     
206.   src[0] = 0xE9;
     
207. 
     
208.   *(DWORD*)(src + 1) = (DWORD)(dst - src) - 5;
     
209. 
     
210.   //VirtualProtect(src, len, dwback, &dwback);
     
211. 
     
212.   return (jmp - len);
     
213. }
     
214. void InitDevice(void)
     
215. {
     
216. 
     
217.   LPDIRECT3D9 pD3d9 = NULL;
     
218.   DWORD oldflag;
     
219. 
     
220.   LPDIRECT3DDEVICE9 pD3DDevice = NULL;
     
221.   pD3d9 = Direct3DCreate9(D3D_SDK_VERSION);
     
222.   if (pD3d9 == NULL)
     
223.   {
     
224.     MessageBox(NULL, L"[ERROR] Direct3DCreate9 失败", L" Error", MB_ICONERROR | MB_ICONSTOP);
     
225.     return;
     
226.   }
     
227.   D3DPRESENT_PARAMETERS pPresentParms;
     
228.   ZeroMemory(&pPresentParms, sizeof(pPresentParms));
     
229.   pPresentParms.Windowed = TRUE;
     
230.   pPresentParms.BackBufferFormat = D3DFMT_UNKNOWN;
     
231.   pPresentParms.SwapEffect = D3DSWAPEFFECT_DISCARD;
     
232.   if (FAILED(pD3d9->CreateDevice(D3DADAPTER_DEFAULT, D3DDEVTYPE_HAL, GetDesktopWindow(), D3DCREATE_SOFTWARE_VERTEXPROCESSING, &pPresentParms, &pD3DDevice)))
     
233.   {
     
234.     MessageBox(NULL, L"[ERROR] CreateDevice Failed", L"Fatal Error", MB_ICONERROR | MB_ICONSTOP);
     
235.     return;
     
236.   }
     
237.   DWORD * dwTable = (DWORD*)pD3DDevice;
     
238.   dwTable = (DWORD*)dwTable[0];
     
239.   PresentRetAddr = dwTable[17] + 5;
     
240.   DetourCreate((PBYTE)dwTable[17], (PBYTE)&Present_Detour, 5);
     
241. 
     
242. }
     
243. void  WINAPI Start()
     
244. {
     
245.   
     
246.   //
     
247.   DWORD hD3D, hCriticalSection;
     
248.   do
     
249.   {
     
250.     hD3D = (DWORD)GetModuleHandle(L"d3d9.dll");
     
251.     Sleep(100);
     
252.   } while (!hD3D);
     
253.   hCriticalSection = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\x74\x07\x00\xFF\x15\x00\x00\x00\x00\x8D\x00\x00", "xx?xx????x??")+5;
     
254.   hCriticalSection =*(DWORD*)hCriticalSection;
     
255.   if (!hCriticalSection)
     
256.   {
     
257.     MessageBox(NULL, L"Error Code (0)", L"Error", MB_ICONERROR);
     
258.     exit(1);
     
259.   }
     
260. 
     
261.   //if (!hReset)
     
262.   //  hReset = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\xFF\x15\x00\x00\x00\x00\x3B\x43\x20\x74\x1B\x8B\x46\x18\x85\xC0\x74\x07\x56", "xx????xxxxxxxxxxxxx");// Win XP
     
263.   //if (!hReset)
     
264.     hReset = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\x57\xFF\x15\x00\x00\x00\x00\x8B\x45\x0C\x33\xF6\x39\x70\x20", "xxx????xxxxxxxx")+7;// Vista - Win7
     
265.   if (!hReset)
     
266.     hReset = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\x33\xC9\x39\x4F\x20\x75\x79\x8D\x44\x24\x38\x89\x44\x24\x1C\x32\xC0\x8B\xDE", "xxxxxxxxxxxxxxxxxxx");// Win 8.0
     
267.   if (!hReset)
     
268.     hReset = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\x8B\xCE\xE8\x00\x00\x00\x00\x8B\x4E\x0C\x48\xF7\xD8", "xxx????xxxxxx");// Win 8.1
     
269.   if (!hReset)
     
270.   {
     
271.     MessageBox(NULL, L"Error Code (1)", L"Error", MB_ICONERROR);
     
272.     exit(1);
     
273.   }
     
274. //  MessageBox(0, L"This", 0, 0);
     
275.   //return;
     
276.   //if (!hEndScene)
     
277.     //hEndScene = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\x57\xFF\x15\x00\x00\x00\x00\xF6\x46\x00\x00\x89\x5D\xFC\x75\x0E\x8B\x86\x00\x00\x00\x00\xA8\x01\xC6\x45\x00\x00\x75\x24", "xxx????xx??xxxxxxx????xxxx??xx")+7; // Win XP
     
278.   //if (!hEndScene)
     
279.     hEndScene = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\x57\xFF\x15\x00\x00\x00\x00\xE9\x00\x00\x00\x00\x39\x5F\x18\x74\x07\x57\xFF\x15\x00\x00\x00\x00\xB8\x00\x00\x00\x00\x8B\x4D\xF4\x64\x89\x0D\x00\x00\x00\x00\x59\x5F\x5E\x5B\x8B\xE5\x5D\xC2\x04\x00\x68\xAD\x06\x00\x00", "xxx????x????xxxxxxxx????x????xxxxxx????xxxxxxxxxxxxx??")+7; // Vista Win7
     
280.   if (!hEndScene)
     
281.     hEndScene = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\x33\xC0\xE8\x00\x00\x00\x00\xC2\x04\x00\x8B\xDF\xEB\x8E\x53\xFF\x15\x00\x00\x00\x00\xEB\x90", "xxx????xxxxxxxxxx????xx")+21;// Win8 8.0 + 8.1               
     
282.   if (!hEndScene)
     
283.   {
     
284.     MessageBox(NULL, L"Error Code (2)", L"Error", MB_ICONERROR);
     
285.     exit(1);
     
286.   }
     
287. 
     
288.   //if (!hDrawIndexPrimtive)
     
289.     //hDrawIndexPrimtive = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\x53\xFF\x15\x00\x00\x00\x00\xF6\x46\x00\x00\x89\x7D\xFC\x74\x24\x39\x7B\x18\x74\x07\x53\xFF\x15\x00\x00\x00\x00\xB8\x00\x00\x00\x00\x8B\x4D\xF4\x64\x89\x0D\x00\x00\x00\x00\x5F\x5E\x5B\x8B\xE5\x5D\xC2\x1C\x00", "xxx????xx??xxxxxxxxxxxxx????x????xxxxxx????xxxxxxxxx")+7;// Win XP
     
290.   //if (!hDrawIndexPrimtive)
     
291.     hDrawIndexPrimtive = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\x56\xFF\x15\x00\x00\x00\x00\xE9\x00\x00\x00\x00\x39\x5E\x18\x74\x07\x56\xFF\x15\x00\x00\x00\x00\xB8\x00\x00\x00\x00\x8B\x4D\xF4\x64\x89\x0D\x00\x00\x00\x00\x59\x5F\x5E\x5B\x8B\xE5\x5D\xC2\x1C\x00\x39\x9E\x00\x00\x00\x00", "xxx????x????xxxxxxxx????x????xxxxxx????xxxxxxxxxxxx????")+7;// Vista - Win7
     
292.   if (!hDrawIndexPrimtive)
     
293.     hDrawIndexPrimtive = FindPattern((DWORD)GetModuleHandle(L"d3d9.dll"), 0xffffff, (PBYTE)"\xE9\x00\x00\x00\x00\x00\xFF\x00\x00\x00\x00\x00\xE9\x00\x00\x00\x00\xC7\x45\x00\x00\x00\x00\x00\x8D\x4D\x00\xE8\x00\x00\x00\x00\xB8\x00\x00\x00\x00\xE9\x00\x00\x00\x00\x83\xBA\x00\x00\x00\x00\x00\x74\x00", "x?????x?????x????xx?????xx?x????x????x????xx?????x?")+12; // Win8 8.0 + 8.1
     
294.   if (!hDrawIndexPrimtive)
     
295.   {
     
296.     MessageBox(NULL, L"Error Code (3)", L"Error", MB_ICONERROR);
     
297.     exit(1);
     
298.   }
     
299. 
     
300.   if (hReset && hEndScene && hDrawIndexPrimtive)
     
301.   {
     
302.     DWORD dwBack;
     
303.     VirtualProtect((void*)(hCriticalSection), 4, PAGE_EXECUTE_READWRITE, &dwBack);
     
304.     pEnterCriticalSection = (EnterCriticalSection_t)*(DWORD*)(hCriticalSection);
     
305.     *(DWORD*)(hCriticalSection) = (DWORD)nEnterCriticalSection;
     
306.     VirtualProtect((void*)(hCriticalSection), 4, dwBack, &dwBack);
     
307.     InitDevice();
     
308.     return ;
     
309.   }
     
310.   
     
311.   return ;
     
312. }
     
313. BOOL WINAPI DllMain(HMODULE hDll, DWORD dwReason, LPVOID lpReserved)
     
314. {
     
315.   if (dwReason == DLL_PROCESS_ATTACH)
     
316.   {
     
317.     CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)Start, NULL, NULL, NULL);
     
318.   }
     
319.   return TRUE;
     
320. }

复制代码

原创公布了 hook方法,但没使用方法, 主流射击游戏通用,此代码仅供学习研究,游戏公司尽早修复漏洞