TA的每日心情 | 开心 2024-12-9 18:45 |
---|
签到天数: 124 天 [LV.7]常住居民III
|
欢迎您注册加入!这里有您将更精采!
您需要 登录 才可以下载或查看,没有账号?注册
x
试验游戏:剑网三(以D3D9为例)
具体实现步骤:
HOOK Direct3DCreate9来获得类型为LPDIRECT3D9的Direct3D对象的接口指针,它有一个成员函数为 IDirect3D9::CreateDevice,所以,只要根据Direct3D对象接口指针找到Direct3D对象的虚函数表,再根据虚函数表确定IDirect3D9::CreateDevice的内存地址,就可以hook这个函数。从而获得类型为LPDIRECT3DDEVICE9的设备对象指针,然后根据设备对象指针找到设备对象的虚函数表,根据虚函数表找到IDirect3DDevice9:resent在内存中的地址,对其进行HOOK,在其中加入sleep函数。
//代码参考runjin
-
- #include <d3d9.h>
- #include <D3dx9core.h>
- #pragma comment(lib, "D3D9.lib")
- #pragma comment(lib, "D3Dx9.lib")
- void GameD3D_HOOK();
- IDirect3D9 * _stdcall New_Direct3DCreate9(UINT SDKVersion);
- HRESULT _stdcall New_CreateDevice(
- LPDIRECT3D9 pDx9,
- UINT Adapter,
- D3DDEVTYPE DeviceType,
- HWND hFocusWindow,
- DWORD BehaviorFlags,
- D3DPRESENT_PARAMETERS * pPresentsentationParameters,
- IDirect3DDevice9 ** pPresentturnedDeviceInterface
- );
- HRESULT _stdcall New_Present(
- LPDIRECT3DDEVICE9 pDxdevice,
- CONST RECT * pSourceRect,
- CONST RECT * pDestRect,
- HWND hDestWindowOverride,
- CONST RGNDATA * pDirtyRegion
- );
- LPDIRECT3D9 m_pD3D=NULL; //Direct3D对象的接口指针
- void * pDirect3DCreate9=NULL;//Direct3DCreate9函数地址指针
- void * pCreateDevice=NULL;//IDirect3D9::CreateDevice函数地址指针
- void * pPresent=NULL;//IDirect3DDevice9::Present函数地址指针
- int Sleeptime=50;//延时时间
- BYTE Direct3DCreate_Begin[5];//用于保存Direct3DCreate9入口的5字节
- BYTE CreateDevice_Begin[5];//用于保存IDirect3D9::CreateDevice入口的字节
- BYTE Present_Begin[5];//用于保存IDirect3DDevice9::Present入口的5字节
- void GameD3D_HOOK()
- {
- //hook Direct3DCreate9
- pDirect3DCreate9=GetProcAddress(GetModuleHandle("d3d9.dll"),"Direct3DCreate9");
- DWORD oldproc=0;
- memcpy(Direct3DCreate_Begin,pDirect3DCreate9,5);
- VirtualProtect(pDirect3DCreate9,5,PAGE_EXECUTE_READWRITE,&oldpro);
- *(BYTE*)pDirect3DCreate9=0xe9;
- *(DWORD*)((BYTE*)pDirect3DCreate9+1)=(DWORD)New_Direct3DCreate9-(DWORD)pDirect3DCreate9-5;
- }
- //当运行到Direct3DCreate9时跳转到这里
- IDirect3D9 * _stdcall New_Direct3DCreate9(
- UINT SDKVersion
- )
- {
- __asm pushad
- memcpy(pDirect3DCreate9,Direct3DCreate_Begin,5);//首先还原入口的5个字节
- m_pD3D=Direct3DCreate9(SDKVersion);
- if(m_pD3D){//如果成功
- pCreateDevice=(void*)*(DWORD*)(*(DWORD*)m_pD3D+0x40);//获得IDirect3D9::CreateDevice的地址指针
- DWORD oldpro=0;
- memcpy(CreateDevice_Begin,pCreateDevice,5);//保存IDirect3D9::CreateDevice入口5个字节
- VirtualProtect(pCreateDevice,5,PAGE_EXECUTE_READWRITE,&oldpro);
- *(BYTE*)pCreateDevice=0xe9;
- *(DWORD*)((BYTE*)pCreateDevice+1)=(DWORD)New_CreateDevice-(DWORD)pCreateDevice-5;
- }else{//如果失败就再hook一次
- DWORD oldpro=0;
- VirtualProtect(pDirect3DCreate9,5,PAGE_EXECUTE_READWRITE,&oldpro);
- *(BYTE*)pDirect3DCreate9=0xe9;
- *(DWORD*)((BYTE*)pDirect3DCreate9+1)=(DWORD)New_Direct3DCreate9-(DWORD)pDirect3DCreate9-5;
- }
- __asm popad
- return m_pD3D;
- }
- //hook CreateDevice
- HRESULT _stdcall New_CreateDevice(
- LPDIRECT3D9 pDx9,
- UINT Adapter,
- D3DDEVTYPE DeviceType,
- HWND hFocusWindow,
- DWORD BehaviorFlags,
- D3DPRESENT_PARAMETERS * pPresentsentationParameters,
- IDirect3DDevice9 ** pPresentturnedDeviceInterface
- )
- {
- __asm pushad
- memcpy(pCreateDevice,CreateDevice_Begin,5);//先还原入口的5个字节
- HRESULT ret=pDx9->CreateDevice( //创建设备
- Adapter,
- DeviceType,
- hFocusWindow,
- BehaviorFlags,
- pPresentsentationParameters,
- pPresentturnedDeviceInterface);
- if (ret==D3D_OK){//如果创建设备成功
- LPDIRECT3DDEVICE9 m_pDevice=*pPresentturnedDeviceInterface;
- pPresent=(void*)*(DWORD*)(*(DWORD*)m_pDevice+0x44);//获得IDirect3DDevice9::Present的地址指针
- memcpy(Present_Begin,pPresent,5);//保存IDirect3DDevice9::Present入口的5个字节
- DWORD oldpro=0;
- VirtualProtect(pPresent,5,PAGE_EXECUTE_READWRITE,&oldpro);
- *(BYTE*)pPresent=0xe9;
- *(DWORD*)((BYTE*)pPresent+1)=(DWORD)New_Present-(DWORD)pPresent-5;
-
- }else{//如果失败再hookIDirect3D9::CreateDevice一次
- DWORD oldpro=0;
- VirtualProtect(pCreateDevice,5,PAGE_EXECUTE_READWRITE,&oldpro);
- *(BYTE*)pCreateDevice=0xe9;
- *(DWORD*)((BYTE*)pCreateDevice+1)=(DWORD)New_CreateDevice-(DWORD)pCreateDevice-5;
- }
- __asm popad
- return ret;
- }
- //当程序运行到IDirect3DDevice9::Present入口处将跳转到这里
- HRESULT _stdcall New_Present(
- LPDIRECT3DDEVICE9 pDxdevice,//类的this指针
- CONST RECT * pSourceRect,//此参数请参考dx sdk
- CONST RECT * pDestRect,//同上
- HWND hDestWindowOverride,//同上
- CONST RGNDATA * pDirtyRegion//同上
- )
- {
- Sleep(Sleeptime);
- __asm pushad
- if(pDirect3DCreate9 && pCreateDevice && pPresent)
- memcpy(pPresent,Present_Begin,5);//先还原IDirect3DDevice9::Present入口的5字节
- HRESULT retdata= pDxdevice->Present(pSourceRect,pDestRect,hDestWindowOverride,pDirtyRegion);
- if(pDirect3DCreate9 && pCreateDevice && pPresent){
- //DWORD oldpro=0;
- //VirtualProtect(pPresent,5,PAGE_EXECUTE_READWRITE,&oldpro);
- //调用完IDirect3DDevice9::Present后再hook一次
- *(BYTE*)pPresent=0xe9;
- *(DWORD*)((BYTE*)pPresent+1)=(DWORD)New_Present-(DWORD)pPresent-5;
- }
- __asm popad
- return retdata;
- }
复制代码 |
|