Win 8 - EndsceneHook

[Endecs]

Hello,

I try the whole of this day, to Hook the Endscene from Win 8, but my Problem is, it's Crash or I only get on all ASM stuff "0" as return.

Crash Code:

  threadHooked = false;
                            // allocate memory to store injected code:
                            injected_code = Memory.AllocateMemory(2048);
                            // allocate memory the new injection code pointer:
                            addresseInjection = Memory.AllocateMemory(0x4);
                            Memory.WriteInt(addresseInjection, 0);
                            // allocate memory the pointer return value:
                            retnInjectionAsm = Memory.AllocateMemory(0x4);
                            Memory.WriteInt(retnInjectionAsm, 0);

                            // Generate the STUB to be injected
                            Memory.Asm.Clear(); // $Asm

                            // save regs
                            Memory.Asm.Clear();

                            Memory.Asm.AddLine("push 14");
                            Memory.Asm.AddLine("mov eax, " + ConvertToHexString(D3D9Module));

                            Memory.Asm.AddLine("pushad");
                            Memory.Asm.AddLine("pushfd");

                            // Test if you need launch injected code:
                            Memory.Asm.AddLine("mov eax, [" + addresseInjection + "]");
                            Memory.Asm.AddLine("test eax, eax");
                            Memory.Asm.AddLine("je @out");

                            // Launch Fonction:
                            Memory.Asm.AddLine("mov eax, [" + addresseInjection + "]");
                            Memory.Asm.AddLine("call eax");

                            // Copie pointer return value:
                            Memory.Asm.AddLine("mov [" + retnInjectionAsm + "], eax");

                            // Enter value 0 of addresse func inject
                            Memory.Asm.AddLine("mov edx, " + addresseInjection);
                            Memory.Asm.AddLine("mov ecx, 0");
                            Memory.Asm.AddLine("mov [edx], ecx");

                            // Close func
                            Memory.Asm.AddLine("@out:");

                            // load reg
                            Memory.Asm.AddLine("popfd");
                            Memory.Asm.AddLine("popad");


                            // injected code
                            uint sizeAsm = (uint)(Memory.Asm.Assemble().Length);
                            Memory.Asm.Inject(injected_code);

                            // Size asm jumpback
                            int sizeJumpBack = 7;

                            // copy and save original instructions
                            Memory.Asm.Clear();
                            Memory.Asm.AddLine("mov edi, edi");
                            Memory.Asm.AddLine("push ebp");
                            Memory.Asm.AddLine("mov ebp, esp");
                            Memory.Asm.Inject(injected_code + sizeAsm);

                            // create jump back stub
                            Memory.Asm.Clear();
                            Memory.Asm.AddLine("jmp " + (pEndScene + sizeJumpBack));
                            Memory.Asm.Inject(injected_code + sizeAsm + (uint)sizeJumpBack);

                            // create hook jump
                            Memory.Asm.Clear(); // $jmpto
                            Memory.Asm.AddLine("jmp " + (injected_code));
                            Memory.Asm.AddLine("nop");
                            Memory.Asm.AddLine("nop");
                            Memory.Asm.Inject(pEndScene);

All 0 Code:

  threadHooked = false;
                            // allocate memory to store injected code:
                            injected_code = Memory.AllocateMemory(2048);
                            // allocate memory the new injection code pointer:
                            addresseInjection = Memory.AllocateMemory(0x4);
                            Memory.WriteInt(addresseInjection, 0);
                            // allocate memory the pointer return value:
                            retnInjectionAsm = Memory.AllocateMemory(0x4);
                            Memory.WriteInt(retnInjectionAsm, 0);

                            // Generate the STUB to be injected
                            Memory.Asm.Clear(); // $Asm

                            // save regs
                            Memory.Asm.Clear();

                            Memory.Asm.AddLine("push 14");
                            Memory.Asm.AddLine("mov eax, " + (ConvertToHexString(D3D9Module) + 0x149A0C));

                            Memory.Asm.AddLine("pushad");
                            Memory.Asm.AddLine("pushfd");

                            // Test if you need launch injected code:
                            Memory.Asm.AddLine("mov eax, [" + addresseInjection + "]");
                            Memory.Asm.AddLine("test eax, eax");
                            Memory.Asm.AddLine("je @out");

                            // Launch Fonction:
                            Memory.Asm.AddLine("mov eax, [" + addresseInjection + "]");
                            Memory.Asm.AddLine("call eax");

                            // Copie pointer return value:
                            Memory.Asm.AddLine("mov [" + retnInjectionAsm + "], eax");

                            // Enter value 0 of addresse func inject
                            Memory.Asm.AddLine("mov edx, " + addresseInjection);
                            Memory.Asm.AddLine("mov ecx, 0");
                            Memory.Asm.AddLine("mov [edx], ecx");

                            // Close func
                            Memory.Asm.AddLine("@out:");

                            // load reg
                            Memory.Asm.AddLine("popfd");
                            Memory.Asm.AddLine("popad");


                            // injected code
                            uint sizeAsm = (uint)(Memory.Asm.Assemble().Length);
                            Memory.Asm.Inject(injected_code);

                            // Size asm jumpback
                            int sizeJumpBack = 7;

                            // copy and save original instructions
                            Memory.Asm.Clear();
                            Memory.Asm.AddLine("mov edi, edi");
                            Memory.Asm.AddLine("push ebp");
                            Memory.Asm.AddLine("mov ebp, esp");
                            Memory.Asm.Inject(injected_code + sizeAsm);

                            // create jump back stub
                            Memory.Asm.Clear();
                            Memory.Asm.AddLine("jmp " + (pEndScene + sizeJumpBack));
                            Memory.Asm.Inject(injected_code + sizeAsm + (uint)sizeJumpBack);

                            // create hook jump
                            Memory.Asm.Clear(); // $jmpto
                            Memory.Asm.AddLine("jmp " + (injected_code));
                            Memory.Asm.AddLine("nop");
                            Memory.Asm.AddLine("nop");
                            Memory.Asm.Inject(pEndScene);

The Code with "0" give an Exception:

"Assembly failed!  Error code: -121;  Error Line: 3
   bei Fasm.ManagedFasm.Assemble(String szSource, Int32 nMemorySize, Int32 nPassLimit)
   bei Fasm.ManagedFasm.Assemble()"

D3D9Module = 0x6387F8DF

/e: The Offsets are right (works with Win7 and XP-Win7 Injection Code)

greets,
Endecs

[Master674]

Hello,

I try the whole of this day, to Hook the Endscene from Win 8, but my Problem is, it's Crash or I only get on all ASM stuff "0" as return.

Crash Code:

  threadHooked = false;
                            // allocate memory to store injected code:
                            injected_code = Memory.AllocateMemory(2048);
                            // allocate memory the new injection code pointer:
                            addresseInjection = Memory.AllocateMemory(0x4);
                            Memory.WriteInt(addresseInjection, 0);
                            // allocate memory the pointer return value:
                            retnInjectionAsm = Memory.AllocateMemory(0x4);
                            Memory.WriteInt(retnInjectionAsm, 0);

                            // Generate the STUB to be injected
                            Memory.Asm.Clear(); // $Asm

                            // save regs
                            Memory.Asm.Clear();

                            Memory.Asm.AddLine("push 14");
                            Memory.Asm.AddLine("mov eax, " + ConvertToHexString(D3D9Module));

                            Memory.Asm.AddLine("pushad");
                            Memory.Asm.AddLine("pushfd");

                            // Test if you need launch injected code:
                            Memory.Asm.AddLine("mov eax, [" + addresseInjection + "]");
                            Memory.Asm.AddLine("test eax, eax");
                            Memory.Asm.AddLine("je @out");

                            // Launch Fonction:
                            Memory.Asm.AddLine("mov eax, [" + addresseInjection + "]");
                            Memory.Asm.AddLine("call eax");

                            // Copie pointer return value:
                            Memory.Asm.AddLine("mov [" + retnInjectionAsm + "], eax");

                            // Enter value 0 of addresse func inject
                            Memory.Asm.AddLine("mov edx, " + addresseInjection);
                            Memory.Asm.AddLine("mov ecx, 0");
                            Memory.Asm.AddLine("mov [edx], ecx");

                            // Close func
                            Memory.Asm.AddLine("@out:");

                            // load reg
                            Memory.Asm.AddLine("popfd");
                            Memory.Asm.AddLine("popad");


                            // injected code
                            uint sizeAsm = (uint)(Memory.Asm.Assemble().Length);
                            Memory.Asm.Inject(injected_code);

                            // Size asm jumpback
                            int sizeJumpBack = 7;

                            // copy and save original instructions
                            Memory.Asm.Clear();
                            Memory.Asm.AddLine("mov edi, edi");
                            Memory.Asm.AddLine("push ebp");
                            Memory.Asm.AddLine("mov ebp, esp");
                            Memory.Asm.Inject(injected_code + sizeAsm);

                            // create jump back stub
                            Memory.Asm.Clear();
                            Memory.Asm.AddLine("jmp " + (pEndScene + sizeJumpBack));
                            Memory.Asm.Inject(injected_code + sizeAsm + (uint)sizeJumpBack);

                            // create hook jump
                            Memory.Asm.Clear(); // $jmpto
                            Memory.Asm.AddLine("jmp " + (injected_code));
                            Memory.Asm.AddLine("nop");
                            Memory.Asm.AddLine("nop");
                            Memory.Asm.Inject(pEndScene);

All 0 Code:

  threadHooked = false;
                            // allocate memory to store injected code:
                            injected_code = Memory.AllocateMemory(2048);
                            // allocate memory the new injection code pointer:
                            addresseInjection = Memory.AllocateMemory(0x4);
                            Memory.WriteInt(addresseInjection, 0);
                            // allocate memory the pointer return value:
                            retnInjectionAsm = Memory.AllocateMemory(0x4);
                            Memory.WriteInt(retnInjectionAsm, 0);

                            // Generate the STUB to be injected
                            Memory.Asm.Clear(); // $Asm

                            // save regs
                            Memory.Asm.Clear();

                            Memory.Asm.AddLine("push 14");
                            Memory.Asm.AddLine("mov eax, " + (ConvertToHexString(D3D9Module) + 0x149A0C));

                            Memory.Asm.AddLine("pushad");
                            Memory.Asm.AddLine("pushfd");

                            // Test if you need launch injected code:
                            Memory.Asm.AddLine("mov eax, [" + addresseInjection + "]");
                            Memory.Asm.AddLine("test eax, eax");
                            Memory.Asm.AddLine("je @out");

                            // Launch Fonction:
                            Memory.Asm.AddLine("mov eax, [" + addresseInjection + "]");
                            Memory.Asm.AddLine("call eax");

                            // Copie pointer return value:
                            Memory.Asm.AddLine("mov [" + retnInjectionAsm + "], eax");

                            // Enter value 0 of addresse func inject
                            Memory.Asm.AddLine("mov edx, " + addresseInjection);
                            Memory.Asm.AddLine("mov ecx, 0");
                            Memory.Asm.AddLine("mov [edx], ecx");

                            // Close func
                            Memory.Asm.AddLine("@out:");

                            // load reg
                            Memory.Asm.AddLine("popfd");
                            Memory.Asm.AddLine("popad");


                            // injected code
                            uint sizeAsm = (uint)(Memory.Asm.Assemble().Length);
                            Memory.Asm.Inject(injected_code);

                            // Size asm jumpback
                            int sizeJumpBack = 7;

                            // copy and save original instructions
                            Memory.Asm.Clear();
                            Memory.Asm.AddLine("mov edi, edi");
                            Memory.Asm.AddLine("push ebp");
                            Memory.Asm.AddLine("mov ebp, esp");
                            Memory.Asm.Inject(injected_code + sizeAsm);

                            // create jump back stub
                            Memory.Asm.Clear();
                            Memory.Asm.AddLine("jmp " + (pEndScene + sizeJumpBack));
                            Memory.Asm.Inject(injected_code + sizeAsm + (uint)sizeJumpBack);

                            // create hook jump
                            Memory.Asm.Clear(); // $jmpto
                            Memory.Asm.AddLine("jmp " + (injected_code));
                            Memory.Asm.AddLine("nop");
                            Memory.Asm.AddLine("nop");
                            Memory.Asm.Inject(pEndScene);

The Code with "0" give an Exception:

"Assembly failed!  Error code: -121;  Error Line: 3
   bei Fasm.ManagedFasm.Assemble(String szSource, Int32 nMemorySize, Int32 nPassLimit)
   bei Fasm.ManagedFasm.Assemble()"

D3D9Module = 0x6387F8DF

/e: The Offsets are right (works with Win7 and XP-Win7 Injection Code)

greets,
Endecs

How do you get pEndScene?
You might also want to take a look at my project here

[Endecs]

                    uint pDevice = Memory.ReadUInt((UInt32)Memory.MainModule.BaseAddress + DX_DEVICE);
                    uint pEnd = Memory.ReadUInt(pDevice + DX_DEVICE_IDX);
                    uint pScene = Memory.ReadUInt(pEnd);
                    uint pEndScene = Memory.ReadUInt(pScene + ENDSCENE_IDX);

All working with Win 7, just not with Win 8.

        Direct3D9__Device = 0xB18ADC,                   // 5.1
        Direct3D9__Device__OffsetA = 0x2808,            // 5.1
        Direct3D9__Device__OffsetB = 0xA8               // 5.1

And moment I will take a look in your Project.

/e: Your Projekt does not help me really :s

greets,
Endecs

[Master674]

I'm using Windows 8 myself. I got no problems with it at all.

[Endecs]

I'm using Windows 8 myself. I got no problems with it at all.

You mean, how I do it, or how you do it in your Projekt?

greets,
Endecs

[Jadd]

You mean, how I do it, or how you do it in your Projekt?

greets,
Endecs

d3dshark works in Windows 8. You should use the same method of hooking it.

[eracer]

If this is for Windows 8, the "original instructions" that you have are not right

                            // copy and save original instructions
                            Memory.Asm.Clear();
                            Memory.Asm.AddLine("mov edi, edi");
                            Memory.Asm.AddLine("push ebp");
                            Memory.Asm.AddLine("mov ebp, esp");
                            Memory.Asm.Inject(injected_code + sizeAsm);

This is what it looks like for Windows 8

push 14
mov eax, d3d9.dll+149A0C

but the address "d3d9.dll+149A0C" would have to be read from the original endscene, so something like

                            // copy and save original instructions
                            Memory.Asm.Clear();
                            Memory.Asm.AddLine("push 0x14");
                            Memory.Asm.AddLine("mov eax, " + Memory.ReadUInt(pEndScene + 3));
                            Memory.Asm.Inject(injected_code + sizeAsm);

[hamburger12]

Do a short jmp to the location pEndscene - 0x5 where you write your jmp to your code cave. Execute your code and add the 2 bytes at the end of the function. Jump back (pEndscene + 0x2) and you are fine ;-)











(+rep xDD wispher)

[eracer]

Do a short jmp to the location pEndscene - 0x5 where you write your jmp to your code cave. Execute your code and add the 2 bytes at the end of the function. Jump back (pEndscene + 0x2) and you are fine ;-)











(+rep xDD wispher)

That should work as long as you know for sure that pEndscene + 0x5 is already allocated and not something important that you're going to overwrite.
You could always patch the VMT address too.

BTW, what is "(+rep xDD wispher)"? Are you asking for rep?

[Cypher]

Do a short jmp to the location pEndscene - 0x5 where you write your jmp to your code cave. Execute your code and add the 2 bytes at the end of the function. Jump back (pEndscene + 0x2) and you are fine ;-)











(+rep xDD wispher)

What if something has already hooked EndScene (i.e. steam)? You need to check whether there is already a jump there, then write that jump into your trampoline if there is.

You should also check whether or not someone has performed a detour on the first 5 bytes of the function rather than utilizing hotpatching. If they have, your method will destroy the instruction and you will try to execute invalid code when you jump into EndScene+0x2.

[Jadd]

What if something has already hooked EndScene (i.e. steam)? You need to check whether there is already a jump there, then write that jump into your trampoline if there is.

Honorbuddy does not check and it drives me insane when my EndScene hooks are overwritten... For the sake of everyone, listen to this guy.

[Cypher]

Honorbuddy does not check and it drives me insane when my EndScene hooks are overwritten... For the sake of everyone, listen to this guy.

Yeah, I don't understand why people just assume they're the only person who wants to hook EndScene (or anything else for that matter). I can understand if you're hooking engine functions or something like that, but if you're going to hook public exported APIs, at least be polite about it and support hook chaining.