Question DX9 Protection?

[xblade2k9]

recently I started with dx, with 8 I haven't problems, but with the 9 if you use a function pointer is "unHooked" alone. This is solved by removing the hook, calling the original and re-hooking. the problem comes when more than one function, the first works perfectly but the second is run/called 8 times and "unhook" alone. Does anyone have some information about this?.

Hook vtable like this:

mov eax,[eax]
mov ecx,dword ptr [eax+0xA8] //EndScene index*4
mov [pEndScene],ecx //save original address to restore in call.
lea ebx,fEndScene //my EndScene
mov dword ptr [eax+0xA8],ebx //hook function

[Lawgiver]

Ok, I don't know if i understood your problem, maybe if you show me some more code...?

So you try to hook one function but its called 8 times? Are you sure you giving the right return value? Some games call a function more often when they return a wrong value! And I am wondering why you are even unhooking? I mean you have the function address saved.. You only have to unhook if you want to call it via the VMT again.

[xblade2k9]

typedef HRESULT(__stdcall* EndScene_)(LPDIRECT3DDEVICE9 pDev);
EndScene_ pEndScene;

HRESULT __stdcall fEndScene(LPDIRECT3DDEVICE9 pDev)
{
 //Draw code
 ...
....
....
....
 
 return pEndScene(pDev);
}

this method is "unhooked" by directx.

if unhook call and rehook work OK calling pDev->EndScene();.

HRESULT __stdcall fEndScene(LPDIRECT3DDEVICE9 pDev)
{
  HRESULT r=NULL;
 
  __asm {
        mov eax,gDev  //Global for testing 
	mov eax,[eax]
	mov eax,[eax]
	mov ecx,[pEndScene]
	mov dword ptr [eax+0xA8],ecx
 }
 r=pDev->EndScene();
 __asm {
        mov eax,gDev
	mov eax,[eax]
	mov eax,[eax]
	mov ecx,dword ptr [eax+0xA8]
	mov [pEndScene],ecx
	lea ebx,fEndScene
        mov dword ptr [eax+0xA8],ebx
 }
 return r;
}

this method work perfect, only in one function if hook other function dx "unhook" the second function and game run perfect.

Look this capture:



SetStreamSource is calles 9 times only....... and EndScene hook is working perfect.....and game run.

[Lawgiver]

And your problem is that it is called 9 times?

[xblade2k9]

And your problem is that it is called 9 times?

yes, if only calls 9 times no log strides/vertices etc to model rec and draw esp.... etc.

[entername]

off topic
I've logged a huge amount of fallout 3 xD

[Lawgiver]

yes, if only calls 9 times no log strides/vertices etc to model rec and draw esp.... etc.

Hm sorry but I don't understand you.

Maybe you could post in your language and let someone translate it because i can unfortunaly barely understand you? :)

[xblade2k9]

Hm sorry but I don't understand you.

Maybe you could post in your language and let someone translate it because i can unfortunaly barely understand you? :)

ok in my language ( spanish )

el problema es que si hookeo solo EndScene funciona todo bien siempre que quite el hook antes de volver a llamar a la funcion, si uso un puntero a funcion DirectX quita el hook y el juego continua ejecutandose con normalidad. pero si hookeo mas de una funcion quite o no quite el hook esa funcion se llama 9 veces y nunca mas vuelve a llamarse.

[entername]

Try to start the game then start your hack.

[xblade2k9]

HRESULT __stdcall fStream(LPDIRECT3DDEVICE9 pDev,UINT StreamNumber,IDirect3DVertexBuffer9* pStreamData,UINT OffsetInBytes,UINT Stride)
{
  HRESULT r=0; 
    	
  Vtable[100]=(DWORD)*Stream; //UnHook
  r=pDev->SetStreamSource(StreamNumber,pStreamData,OffsetInBytes,Stride);
  Vtable[100]=(DWORD)fStream; //Hook
  veces++;                                   //Count calls
  if (r==D3DERR_INVALIDCALL)   // if error
  {
   MessageBox(0,"a","a",64);
  }
  return r;
}

if not unHooked calls 1 time and dx unhook this function. EndScene work perfect.....

[xblade2k9]

mira las capturas y te daras cuenta del problema, es bastante raro ya que en directx8 no tengo ningun problema.










no logro entender que es lo que pasa, endscene funciona y la otra solo unas veces.

[xblade2k9]

Solved, UnHook all hooked functions call and rehook all functions :).

Gracias x todo :).

[Lawgiver]

Solved, UnHook all hooked functions call and rehook all functions :).

Gracias x todo :).

I don't even understand why you UnHook?

You are doing something like this: (?)

VTable[100] = OriginalFunction;
VTable->100dredFunction();
VTable[100] = MyHook;

I don't understand that. Why not just do:

OriginalFunction();

It will be the same unless the function calls itself somehow.

You may have to set ECX ( the classptr ) manually before calling your function but im pretty sure that it should not change. ;)

[xblade2k9]

ahora estoy usando punteros a funcion directamente, pero o quito los hooks o dejan de funcionar.

  QuitarHook(42);
  QuitarHook(82);
  QuitarHook(100);
  r=Stream(pDev,StreamNumber,pStreamData,OffsetInBytes,Stride);
  PonerHook(42,fEndScene);
  PonerHook(100,fStream);
  PonerHook(82,fPrimi);

ya le di muchas vueltas y es la unica forma que me funciona.