Good evening everyone,
well after some out of process projects i started to learn basic of hooking/injecting.
I looked into Microsoft Research, but in my opinion it's not the best libary to hook games.
However, I need a bit help because I know I'm doing it wrong and I could need some help.
I've started to write my entrypoint for my DLL
Code:
BOOL APIENTRY DllMain(
HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved)
{
switch(ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
{
CreateThread(0, 0, (LPTHREAD_START_ROUTINE) InitHook, 0, 0, 0);
}
case DLL_PROCESS_DETACH:
{
MessageBox(0, L"detach", L"", 0);
}
}
return true;
}
As you can see I start my own thread and I call my InitHook() function which does work after I have my DLL injected.
Code:
void InitHook()
{
HMODULE hModule = NULL;
// Test
while (!hModule)
{
hModule = GetModuleHandleA("d3d9.dll");
Sleep(100);
}
// Initializes hook
pEndScene = (EndScene_t)DetourFunc((PBYTE) (void*)((0x00BB672C + 0x397C) + 0xA8), (PBYTE)hkEndScene, 5);
}
In this function I get the module handle of d3d9.dll and I initialize my pEndScene object with [[0x00BB672C + 0x397C] + 0xA8] which should be the EndScene adress. I've found a sample function to replace WoW's EndScene with my EndScene but I don't know if that is the right way cause I don't know much about hooking.
Code:
//-----------------------------------------------------------------------------
void *DetourFunc(BYTE *aSrc, const BYTE *aDst, const int aLen)
{
MessageBox(0, L"Own Endscene!", L"detour func", 0);
BYTE *jmp = (BYTE*)malloc(aLen + 5);
DWORD dwBack;
VirtualProtect(aSrc, aLen, PAGE_READWRITE, &dwBack);
memcpy(jmp, aSrc, aLen);
jmp += aLen;
jmp[0] = 0xE9;
*(DWORD*)(jmp + 1) = (DWORD)(aSrc + aLen - jmp) - 5;
aSrc[0] = 0xE9;
*(DWORD*)(aSrc + 1) = (DWORD)(aDst - aSrc) - 5;
VirtualProtect(aSrc, aLen, dwBack, &dwBack);
return (jmp - aLen);
}
On the top of my dllmain, I also added a typedef to EndScene and my own EndScene function,
Code:
typedef HRESULT(__stdcall *EndScene_t)(LPDIRECT3DDEVICE9);
EndScene_t pEndScene;
HRESULT __stdcall hkEndScene(LPDIRECT3DDEVICE9 pDevice)
{
// todo: testing if this ever get called <.<..
MessageBox(0, L"Own Endscene!", L"WTF!! it works!", 0);
return pEndScene(pDevice);
};
If i run it, it first crashed WoW cause I used another address. Now everything seems to work, but hkEndScene() never get's called.
As I already mentioned, I do not know much about hooking, so I want to ask you to lookup my code and tell me what's wrong or where I can readup more basics (maybe with samples)
Thanks in advance
Unkn0wn0x