Cheat Engine

zm0d

Hi all,

I'm interested in DirectX hacking now. I know that you usually hook the EndScene function from the d3d9.dll to gain access to the drawing object and being able to draw in every frame that gets displayed. Well, yesterday I used The Forest and Farming Simulator 15 just to check out if those games use the d3d9.dll and the EndScene method. I clicked on Memory View and then in the menupoint Enumerate DLLs and Symbols I looked for the d3d9.dll. Found it but wasn't able to find the EndScene function. Only a EndEvent function was listed there. I didnt really understand what this EndEvent is doing and I wonder why EndScene isn't listed there? I thought it somehow an important function.

atom0s · Posted: Mon Nov 10, 2014 4:40 am Post subject:

EndScene is not a global function. It is a function located within the IDirect3DDevice9 object. You need to either globally wrap the full object, or vtable hook the EndScene call.

EndScene is offset 42 in the vtable of the IDirect3DDevice9 object.

Inside of d3d9.h you'll find:

zm0d · Posted: Mon Nov 10, 2014 5:56 am Post subject:

Okay, I didnt get everything.
How or where do I have to place my detour in this VTable. I guess I have to get the start address of EndScene. Where it's defined and not declared.

Wouldn't it work to get the base address of the loaded d3d9.dll and add the offset to jump to the EndScene function? Like:"d3d9.dll"+0x1337 = EndScene

atom0s · Posted: Mon Nov 10, 2014 3:04 pm Post subject:

You need to locate the device pointer and place the detour onto the devices vtable.

A common method to do this is with a universal signature for D3D9:
33 C0 C7 06 ?? ?? ?? ?? 89 86 ?? ?? ?? ?? 89 86
(+4 from where this is found is the device pointer.)
(Search for this only within d3d9.dll!)

This will find the device pointer for you in any D3D9 game. From here you will have the full vtable of the device.

If you don't know already, vtables are just a block of pointers (4 bytes each) to the functions and such of a class/object. So this means we have to multiply the offset by 4 to get the valid pointer in the vtable.

For example, EndScene is offset 42 in the vtable. So it actually is:
42*4 = 168 (0xA8)

So to break down what to do in steps:
- Search for: 33 C0 C7 06 ?? ?? ?? ?? 89 86 ?? ?? ?? ?? 89 86 within d3d9.dll
- Add +4 to the starting address of where the pattern is found.
- Add (offset * 4) of the function in the IDirect3DDevice9 vtable you want to hook.
- Apply your vtable hook / detour with the new address you have.

And you should be all set.

Keep in mind, searching for this pattern globally in all address space will yield other results. This is not what you want! D3D9 can sub-load other modules (such as d3dx9_XX.dll's) which will also contain the pattern but will give you a bad pointer to the device vtable. You need to only search within the real d3d9.dll.

zm0d · Posted: Tue Nov 11, 2014 4:25 am Post subject:

Wow, I guess I got it =) That was really helpfull mate. Smile

Gonna try it out this week. My fingers are itching, but less time atm :>

zm0d · Posted: Wed Nov 12, 2014 3:59 pm Post subject:

Okay, I was able to get the device pointer with a VMT hook to EndScene. Also I was able to draw a rectangle with my hooked end scene function. Well, the rectangle was completly filled and I wonder how I can draw a rectangle with no filling? So borders only. Like ESP boxes used for wallhacks.

Dark Byte · Posted: Wed Nov 12, 2014 4:33 pm Post subject:

Basic d3d programming.
You could use a png with transparency, or a colorkey, or draw 4 rectangles making up the border of a rectangle

zm0d · Posted: Thu Nov 13, 2014 3:00 am Post subject:

Hum okay

thought there is such a drawing function integrated Razz

thanks

atom0s · Posted: Thu Nov 13, 2014 5:32 am Post subject:

You need to draw your own primitives to the screen. Instead of just using something like a call to IDirect3DDevice9::Clear, you instead, need to use DrawIndexedPrimitive / DrawIndexedPrimiveUp.

Like Dark Byte said, its fairly basic Direct3D programming to draw a line as well as a whole box.

zm0d · Posted: Thu Nov 13, 2014 6:37 am Post subject:

Okay I'm gonna check this out.

My next question is, how to convert 3D coordinates to 2D screen coordinates? Is there a function in directx to do so? Someone of you got a (generic?) WorldTo2DCoords function, that he/she would provide? Smile

I break my head about how to do it... I guess I need also more informations, like where my ingame viewport is placed, but I dont know how to obtain this :> I'm missing the relations between viewport, 3d coords and 2d coords, to do the maths and provide a solution for my given problem :/

atom0s · Posted: Thu Nov 13, 2014 2:57 pm Post subject:

WorldToScreen can differ per-game as it depends on how things are projected and such. In some cases, it will be simple, others it can require obtaining information from the game engine to properly obtain the info.

You will typically need the following information:
- The 3D coords of the object you want to find the screen coords for.
- The view port of the device. (IDirect3DDevice9::GetViewPort)
- The projection matrix. (IDirect3DDevice9::GetTransform via D3DTS_PROJECTION)
- The view matrix. (IDirect3DDevice9::GetTransform via D3DTS_VIEW)

Once you have this information, you can use the D3DXVec3Project method to convert the data to screen coords.

Again this may not work for all games, it really depends on how they are coded.

There are a lot of World2Screen examples on various FPS hacking sites that you can check out to for game / engine specific usage.

zm0d · Posted: Thu Nov 13, 2014 4:52 pm Post subject:

This sounds great. Thank you very much. You guys got so much knowledge and I highly appreciate that you are sharing them. Smile