D3D Causing Crash

[WgetProgramer]

I'm doing d3d menu for wow 3.3.5a , however to inject the dll is causing error in wow .

BOOL WINAPI DllMain(HMODULE hDll, DWORD dwReason, LPVOID lpReserved)
{
    if (dwReason != DLL_PROCESS_ATTACH)
        return FALSE;

    DisableThreadLibraryCalls(hDll);
    LoadLibrary("d3d9.dll");
    CreateThread(nullptr, 0, reinterpret_cast<LPTHREAD_START_ROUTINE>(D3Dinit), nullptr, 0, nullptr);

    return TRUE;
}  

int D3Dinit(void)
{
    DWORD hD3D, adr, *vtbl;
    hD3D = 0;
    do
    {
        hD3D = (DWORD)GetModuleHandle("d3d9.dll");
        Sleep(10);
    } while (!hD3D);
    adr = FindPattern((DWORD)GetModuleHandle("d3d9.dll"), 0x128000, (PBYTE)"\xC7\x06\x00\x00\x00\x00\x89\x86\x00\x00\x00\x00\x89\x86", "xx????xx????xx");
    if (adr)
    {
        memcpy(&vtbl, (void *)(adr + 2), 4);
        pReset = (oReset)DetourFunction((PBYTE)vtbl[16], (PBYTE)Reset, 5);
        pEndScene = (oEndScene)DetourFunction((PBYTE)vtbl[42], (PBYTE)EndScene, 5);
    }
    return 0;
}  

[Jadd]

Could be anything from a wrong pattern signature to wrong function definition to an error in the detour method. Be more specific: provide your Reset and EndScene detour functions and a crash message from WoW.

Also, why is this necessary?

LoadLibrary("d3d9.dll");  

[WgetProgramer]

http://puu.sh/cAi0n/3cc82626c3.png

[Midi12]

Maybe try to elevate memory privileges with VirtualProtect function (Windows).

Are you detouring by modifying the vtable or by writting a jump instruction at the beginning of EndScene ?

Oh btw look at this source, if I remember right his D3D hook was working well for 3.3.5 : http://www.ownedcore.com/forums/worl...n-scanner.html (EverScan - An Open Source Warden Scanner)

[WgetProgramer]

Mid12, yes I am using VirtualProtect

void *DetourFunction (BYTE *src, const BYTE *dst, const int len)
{
        BYTE *jmp = (BYTE*)malloc(len+5);
        DWORD dwBack;

        VirtualProtect(src, len, PAGE_EXECUTE_READWRITE, &dwBack);
        memcpy(jmp, src, len);  
        jmp += len;
        jmp[0] = 0xE9;
        *(DWORD*)(jmp+1) = (DWORD)(src+len - jmp) - 5;
        src[0] = 0xE9;
        *(DWORD*)(src+1) = (DWORD)(dst - src) - 5;
        for (int i=5; i<len; i++)  src[i]=0x90;
        VirtualProtect(src, len, dwBack, &dwBack);
        return (jmp-len);
}  

[Midi12]

Firstly I suggest you to wrap your VirtualProtect function calls inside some "If" statements, just to be sure accessing this memory section is ok.
On a second step, EndScene prototype should be

HRESULT WINAPI EndScene(IDirect3DDevice9 *pDevice)

and Reset should be

HRESULT WINAPI Reset(IDirect3DDevice9 *pDevice, D3DPRESENT_PARAMETERS *pPresentationParameters)

.

Also you can improve a bit by doing this :

FindPattern(hD3D, 0x128000, (PBYTE)"\xC7\x06\x00\x00\x00\x00\x89\x86\x00\x00\x00\x00\x89\x86", "xx????xx????xx");

.
Btw, your detour function looks ok.

[WgetProgramer]

I resolved the error
using VirtualProtect in FindPattern

DWORD FindPattern(DWORD dwAddress,DWORD dwLen,BYTE *bMask,char * szMask)
{
        DWORD dwBack;

        VirtualProtect((LPVOID)dwAddress, dwLen, PAGE_EXECUTE_READWRITE, &dwBack);
        for (DWORD i = 0; i < dwLen; i++)
        {
            if (bCompare((BYTE*)(dwAddress + i), bMask, szMask))
            {
                VirtualProtect((LPVOID)dwAddress, dwLen, dwBack, &dwBack);
                return (DWORD)(dwAddress + i);
            }
        }
        VirtualProtect((LPVOID)dwAddress, dwLen, dwBack, &dwBack);
        return 0;
}  

porem agora está causando crash

http://puu.sh/cASBT/62ba84f186.jpg

Reset

HRESULT WINAPI Reset(IDirect3DDevice9* pDevice, D3DPRESENT_PARAMETERS* pPresentationParameters)
{
    dMenu.pFont->OnLostDevice();

    HRESULT hRet = pReset(pDevice, pPresentationParameters);

    dMenu.pFont->OnResetDevice();

    return hRet;
}  

EndScene

HRESULT WINAPI EndScene(LPDIRECT3DDEVICE9 pDevice)
{
    ReFont(pDevice);
    dMenu.BuildMenu("~ WgetProgramer ~", 10, 0, 700, 2000, YELLOW, BLACK, RED, pDevice);
    WoWThread();
    return pEndScene(pDevice);
}  

D3DHook

int D3Dinit(void)
{
    DWORD hD3D, adr, *vtbl;
    hD3D = 0;
    do
    {
        hD3D = (DWORD)GetModuleHandle("d3d9.dll");
        Sleep(10);
    } while (!hD3D);
    adr = FindPattern((DWORD)GetModuleHandle("d3d9.dll"), 0x128000, (PBYTE)"\xC7\x06\x00\x00\x00\x00\x89\x86\x00\x00\x00\x00\x89\x86", "xx????xx????xx");
    if (adr)
    {
        memcpy(&vtbl, (void *)(adr + 2), 4);
        pReset = (oReset)DetourFunction((PBYTE)vtbl[16], (PBYTE)Reset, 5);
        pEndScene = (oEndScene)DetourFunction((PBYTE)vtbl[42], (PBYTE)EndScene, 5);
    }
    return 0;
}  

[Midi12]

You should try to check if your detour is working before trying your menu.

HRESULT WINAPI EndScene(LPDIRECT3DDEVICE9 pDevice)
{
    MessageBox(nullptr, L"test", L"test", MB_OK);
    return pEndScene(pDevice);
}

[WgetProgramer]

You should try to check if your detour is working before trying your menu.

HRESULT WINAPI EndScene(LPDIRECT3DDEVICE9 pDevice)
{
    MessageBox(nullptr, L"test", L"test", MB_OK);
    return pEndScene(pDevice);
}

gave crash

Entry.cpp

#include <Windows.h> 
#include "MenuD3D.h" 
 
BOOL WINAPI DllMain(HMODULE hDll, DWORD dwReason, LPVOID lpReserved) 
{ 
    if (dwReason != DLL_PROCESS_ATTACH) 
        return FALSE; 
 
    DisableThreadLibraryCalls(hDll); 
    CreateThread(nullptr, 0, reinterpret_cast<LPTHREAD_START_ROUTINE>(D3Dinit), nullptr, 0, nullptr); 
 
    return TRUE; 
}