__declspec(naked) HRESULT WINAPI OldDrawIndexedPrimitive(LPDIRECT3D9 pD3D,UINT Adapter,
D3DDEVTYPE DeviceType,
HWND hFocusWindow,
DWORD BehaviorFlags,
D3DPRESENT_PARAMETERS *pPresentationParameters,
IDirect3DDevice9** ppReturnedDeviceInterface)
{//添加这个前缀是为保证汇编代码不被编译器修改
__asm
{
mov edi,edi
push ebp
mov ebp,esp
mov eax,DIPadd+5
jmp eax
}
}
long GetDIP()
{
HMODULE HAND=GetModuleHandle(L"d3d9.dll");
if(HAND==NULL)
{
return NULL;
}
return (long)HAND+0x22E0E;
}
//地址long 数据dword
HRESULT WINAPI MyDrawIndexedPrimitive(LPDIRECT3D9 pD3D,UINT Adapter,
D3DDEVTYPE DeviceType,
HWND hFocusWindow,
DWORD BehaviorFlags,
D3DPRESENT_PARAMETERS *pPresentationParameters,
IDirect3DDevice9** ppReturnedDeviceInterface)
{
HRESULT REU;
//char s[512];
//sprintf_s(s,"add=%d",REU);
//MessageBoxA(0,"已被HOOK函数","已被HOOK函数",0);
HRESULT REUp;
REU=OldDrawIndexedPrimitive(pD3D,Adapter,DeviceType,hFocusWindow,BehaviorFlags,pPresentationParameters,ppReturnedDeviceInterface);
//MessageBoxA(0,LPCSTR(*ppReturnedDeviceInterface),"指针地址",0);
(*ppReturnedDeviceInterface)->SetRenderState(D3DRS_ZENABLE,FALSE);
//MessageBoxA(0,(LPCSTR)s,(LPCSTR)s,0);
return REU;
}
void loading()
{
DIPadd=GetDIP();
DWORD oldprotect;
DWORD jmpto=(DWORD)MyDrawIndexedPrimitive-DIPadd-5;
VirtualProtect((LPVOID)DIPadd,5,PAGE_EXECUTE_READWRITE,&oldprotect);
__asm
{
mov eax,DIPadd;
mov byte ptr[eax],0xE9
add eax,1
mov ebx,jmpto
mov dword ptr[eax],ebx //曾经编译失败过
}
VirtualProtect((LPVOID)DIPadd,5,oldprotect,&oldprotect);
}
LRESULT CALLBACK HookProc(int ncode,WPARAM wparam,LPARAM lparam)
{
return CallNextHookEx(m_hook,ncode,wparam,lparam);
}
DLL_API void BeginHook()
{
m_hook=SetWindowsHookEx(WH_CBT,HookProc,GetModuleHandle(L"DLL.dll"),0);//改了的
}
DLL_API void EndHook()
{
UnhookWindowsHookEx(m_hook);
}
void CheckWindows()
{
//MessageBoxA(0,"SUCCESS!","江寒夜",0);
HWND hwnd = ::FindWindowW(L"ZBufferTest",NULL);//通过窗口类获得窗口句柄
DWORD pid;
GetWindowThreadProcessId(hwnd,&pid);
if(GetCurrentProcessId()==pid)
{
MessageBoxA(0,"成功","success",0);
loading();
}
}
这个是拿之前写的HookDrawIndexedPrimitive的源码改的，这个例程没有使用到DrawIndexedPrimitive这个函数，所以想从CreateDevice这个地方hook获取到它返回的创建设备的指针，然后禁用Z缓冲达到透视的效果。这个历程我事先在createdevice之前添加了loadlibrary命令加载我的DLL，似乎在回调的时候发生了错误导致程序停止工作，，求大大们帮看看
顺便说一下，虽然写的是MyDrawIndexedPrimitive，但用的偏移是CreateDevice的偏移，之前的源码函数名没有改
[招生]系统0day安全班，企业级设备固件漏洞挖掘，Linux平台漏洞挖掘！
