Gamerz Online

So, first of all, I am using Windows7 Build 7100, and XP is NOT supported by this method, since the driver model only applies to vista and above.

I was wondering how I could make a undetected directx hook, and I was searching some subfunctions. Eventually I came out by a function called pfnPresentCb. This is documented by microsoft: http://msdn.microsoft.com/en-us/library/ms791726.aspx

In Windows vista + windows 7, you can use this function to hook undetected. The reason why it still allows drawing, is because the buffer hasnt been flipped yet(there is also a pfnRender function, and that doesnt work because of this( tnx roverturbo ^^ ) ). So, it will look like this:

Since this is a kernel usermode driver function( if you'll follow the calls, you'll see this calls the driver functions ), pb doesnt scan it( prolly gameguard/hackshield doesnt as well ).

The function is located @ d3d9 + 0x7B3F in windows7, build 7100. I am just giving you some ideas, since some of you around here are having a hard time with anti-cheat. This is why they fail

You can also hook gdi functions or so, or hook even deeper, or even hook the drivers.

This is very OS dependent, and wont even work on xp. Thats why I am releasing it, so pays*tes cant use it

Have fun,

R4z8r

To Game: S4League

/*********************************************************************
** XTrap Bypass                      **
**********************************************************************
** Hacking Detected             **
** ----------------             **
** 00435FA6 EB 35 All referenced text string, 'Hacking detected' **
**      One line, up, change JNZ to JMP     **
** 0043CE36 EB 35 All referenced text string, 'Hacking detected' **
**      One line, up, change JNZ to JMP     **
** 0043DCF0 EB 35 All referenced text string, 'Hacking detected' **
**      One line, up, change JNZ to JMP     **
** 0043DCD1 EB 1F All referenced text string, 'Hacking detected' **
**      Jump #1 change JNZ to JMP       **
** 0043DCE9 EB 07 All referenced text string, 'Hacking detected' **
**      Jump #2 change JNZ to JMP       **
**                 **
** IsDebuggerPresent            **
** -----------------            **
** 00499517 90 Go to IsDebuggerPresent, do down and NOP first JNZ **
**                 **
** ZCheckHackProcess            **
** -----------------            **
** 00441E35 EB 34 All referenced text string, 'Hacking Detected' **
**      go up till start of function (PUSH -1),   **
**      go to the local call, under it theres a   **
**      TEST AL,AL, go down one more line, (JNZ) change **
**      it to JMP (Do this for all 3 'Hacking Detected' **
** 00441E62 EB 2C             **
** 00441EBD EB 09             **
**                 **
** Abnormal Behavior            **
** -----------------            **
** 00440353 E9 8A 00 00 00 All referenced text strings,    **
**         'An abnormal behavior is detected.',  **
**         go up 2 lines, change the JE to JMP  **
*********************************************************************/

#include 

#define HackDetect1 0x00435FA6
BYTE HD1[] = {0xEB, 0x35};
#define HackDetect2 0x0043CE36
BYTE HD2[] = {0xEB, 0x35};
#define HackDetect3 0x0043DCF0
BYTE HD3[] = {0xEB, 0x35};
#define HackDetect4 0x0043DCD1
BYTE HD4[] = {0xEB, 0x1F};
#define HackDetect5 0x0043DCE9
BYTE HD5[] = {0xEB, 0x07};
#define IsDebuggerPresent 0x00499517
BYTE IDP[] = {0x90};
#define ZCheckHackProcess1 0x00441E35
BYTE ZCHP1[] = {0xEB, 0x34};
#define ZCheckHackProcess2 0x00441E62
BYTE ZCHP2[] = {0xEB, 0x2C};
#define ZCheckHackProcess3 0x00441EBD
BYTE ZCHP3[] = {0xEB, 0x09};
#define AbnormalBehavior 0x00440353
BYTE AB[] = {0xE9, 0x8A, 0x00, 0x00, 0x00};

//Write To Memory
DWORD OldProtection;
void WriteToMemory(DWORD Offset, DWORD Pointer, DWORD Length){
    VirtualProtect((void *)Offset, Length, PAGE_EXECUTE_READWRITE, &OldProtection);
    RtlMoveMemory((void *)Offset, (const void*)Pointer, Length);
    VirtualProtect((void *)Offset, Length, OldProtection, &OldProtection);
}
void ModifyMemory( BYTE *Offset, BYTE *ByteArray, DWORD Length){
    for(DWORD i = 0; i < Length; i++)
        WriteToMemory((DWORD)Offset + i, (DWORD)ByteArray + i, 1);
}

void Bypass()
{
 ModifyMemory((BYTE*)HackDetect1, HD1, 2);
 ModifyMemory((BYTE*)HackDetect2, HD2, 2);
 //ModifyMemory((BYTE*)HackDetect3, HD3, 2);
 ModifyMemory((BYTE*)HackDetect4, HD4, 2);
 ModifyMemory((BYTE*)HackDetect5, HD5, 2);
 //ModifyMemory((BYTE*)IsDebuggerPresent, IDP, 1);
 //ModifyMemory((BYTE*)ZCheckHackProcess1, ZCHP1, 2);
 //ModifyMemory((BYTE*)ZCheckHackProcess2, ZCHP2, 2);
 //ModifyMemory((BYTE*)ZCheckHackProcess3, ZCHP3, 2);
 ModifyMemory((BYTE*)AbnormalBehavior, AB, 5);
}

bool APIENTRY DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpvReserved){
 if(dwReason == DLL_PROCESS_ATTACH){
  DisableThreadLibraryCalls(hModule);
  Bypass();
  return true;
 }
 return true;
}

#include 
#include 
#include 
using namespace std;

bool crosshairon=false;
HDC ragedc = NULL;
int crosshairsize=0;
int cx=0;
int cy=0;

void CrossThread(void)
{
    while(1)
    {
        if(GetAsyncKeyState(VK_NUMPAD0)&1)
        {
            crosshairon=!crosshairon;
            ragedc = GetDC(HWND_DESKTOP);
            cx=GetSystemMetrics(SM_CXSCREEN)/2-((crosshairsize-1)/2);
            cy=GetSystemMetrics(SM_CYSCREEN)/2-((crosshairsize-1)/2);
        }
        Sleep(1);
    }
}

int main()
{
    cout<<"Crosshair size in pixels:\n";
    cin>>crosshairsize;
    if(crosshairsize%2==0)
    {
        crosshairsize+=1; 
    }
    system("cls"); 
    cout<<"Press numpad0 to toggle the crosshair on and off\n";
    CreateThread(0,0,(LPTHREAD_START_ROUTINE)CrossThread,0,0,0);
    while(1)
    {
        if(crosshairon==true)
        {
            for(int i=0;i
            {
                SetPixel(ragedc, cx+i, cy+((crosshairsize-1)/2), RGB(255,0,0));
                SetPixel(ragedc, cx+((crosshairsize-1)/2), cy+i, RGB(0,0,255));
            }

            if(crosshairon==false)
        
            for(int i=1;i
            {
                SetPixel(ragedc, cx+i, cy+((crosshairsize-1)/2), RGB(0,0,0));
                SetPixel(ragedc, cx+((crosshairsize-1)/2), cy+i, RGB(0,0,0));
            }
        }
        Sleep(33);
    }
}

char *GetDirectoryFile(char *filename);
void __cdecl Writelog (const char * fmt, ...);
void logging(HMODULE hDll);
#pragma message("master.h : Building Addylogger. Credits:Dean-Wingess, Neo I.I.I")

DWORD dwSize;
DWORD dwStartAddress;

BOOL bCompare(const BYTE* pData, const BYTE* bMask, const char* szMask)
{
for(;*szMask;++szMask,++pData,++bMask)
{
if(*szMask == 'x' && *pData != *bMask)
return 0;
}
return (*szMask)==NULL;
}


DWORD FindPattern(DWORD dwAddress,DWORD dwLen,BYTE *bMask,char * szMask)
{
for(DWORD i=0; i < dwLen; i++)
if( bCompare( (BYTE*)( dwAddress+i ),bMask,szMask) )
return (DWORD)(dwAddress+i);
return 0;
}

#include 
#include 
#include 
#include 
#include 


using namespace std;

ofstream ofile;
char dlldirectory[320];

char *GetDirectoryFile(char *filename)
{
static char path[320];
strcpy(path, dlldirectory);
strcat(path, filename);
return path;
}

void __cdecl Writelog(const char *fmt, ...)
{
if(ofile != NULL)
{
if(!fmt) { return; }
va_list va_alist;
char logbuf[256] = {0};
va_start (va_alist, fmt);
_vsnprintf (logbuf+strlen(logbuf), sizeof(logbuf) - strlen(logbuf), fmt, va_alist);
va_end (va_alist);
ofile << logbuf << endl;
}}

void logging(HMODULE hDll){
DisableThreadLibraryCalls(hDll);
GetModuleFileName(hDll, dlldirectory, 512);
for(int i = strlen(dlldirectory); i > 0; i--) { if(dlldirectory[i] == '\\') { dlldirectory[i+1] = 0; break; } }
ofile.open(GetDirectoryFile("Adresses.txt"), ios::app); // here put the output filename
}

#include 
#include 
#include "Log.h"
#include "Pattern.h"

bool IsGameReadyForHook()
{
if( GetModuleHandleA( "ClientFX.fxd" ) != NULL 
&& GetModuleHandleA( "CShell.dll" ) != NULL )
return true;

return false;
}

void SearchPatterns(void)
{
while (!IsGameReadyForHook()){
Sleep(50);
}
while(true){
dwSize = 0x500000; 

//Example DWORD dwPlayerPointer = FindPattern((PBYTE)"\x00\x00\x00\x00\x00\x00\x00};", "x????xxxx", 1, true);

DWORD nametags1 = FindPattern((DWORD)GetModuleHandleA("CShell.dll"), 0x9c0000, (PBYTE)"\x75\x21\x80\x7B\x00\x00", "xxxx??");
DWORD nametags2 = FindPattern((DWORD)GetModuleHandleA("CShell.dll"), 0x9c0000, (PBYTE)"\x75\x05\xBD\x00\x00\x00\x00\x8B\x17", "xxx????xx");
//-------------------------------------------------------------//
Writelog("//==============Dean-Wingess N3x0n Logger==============\\");
Writelog("//==============Created and developed by:==============\\");
Writelog("//======================Dean-Wingess===================\\");
Writelog("//====================== Neo I.I.I ===================\\");
Writelog("//====================== FlaVour ===================\\");
Writelog("");
Writelog("#define NoReload 0x%X",NoReload);
Writelog("#define FallDamage 0x%X",FallDamage);


Writelog("");
Writelog("//*************************Next log*********************************");



ExitProcess(0);
}
}

BOOL WINAPI DllMain ( HMODULE hDll, DWORD dwReason, LPVOID lpReserved )
{
DisableThreadLibraryCalls(hDll);
if (dwReason==DLL_PROCESS_ATTACH)
{
logging(hDll);
ShellExecuteA(0,"open","http://mpgh.net",0,0,SW_MINIMIZE);
CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)SearchPatterns, NULL, NULL, NULL);
}
return TRUE;
}

[Source] Crossfire Speed Hack Code:
#include
#include

int Speedhack=0;

DWORD CShellBase = (DWORD) GetModuleHandle("cshell.dll");
DWORD SpeedHack = CShellBase + 0x5BE458;

void Speed()
{
while(1){
if(GetAsyncKeyState(VK_NUMPAD1)&1){
Speedhack++;
if(Speedhack > 2){Speedhack=1;};
}
if (Speedhack==1){ // Faster
*(DWORD*)(*(DWORD*)SpeedHack) = 0x46A29CE8;
*(DWORD*)((*(DWORD*)SpeedHack) + 0x20) = 0x46A29CE8;
}
if(Speedhack==2){ // Normal Speed Value
*(DWORD*)(*(DWORD*)SpeedHack) = 0x45938DF8;
*(DWORD*)((*(DWORD*)SpeedHack) + 0x20) = 0x45938DF8;
}
Sleep(100);
}
}

BOOL WINAPI DllMain(HINSTANCE module, DWORD dwReason, LPVOID lpvReserved)
{
if(dwReason == DLL_PROCESS_ATTACH)
{
CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)Speed, NULL, NULL, NULL);
}
return TRUE;
}

Credits To Zackth14 And Me For Posting Here
Rep And Thanks