另类D3DHOOK

#include <d3d8.h>
#include <d3dx8.h>
#pragma comment(lib, "d3dx8.lib")
typedef HRESULT ( WINAPI* oPresent ) ( LPDIRECT3DDEVICE8 pDevice, CONST RECT* pSourceRect,CONST RECT* pDestRect,HWND hDestWindowOverride,CONST RGNDATA* pDirtyRegion);
oPresent pPresent;
void *DetourFunc(BYTE *src, const BYTE *dst, const int len)
{
BYTE *jmp = (BYTE*)malloc(len+5);
DWORD dwBack;
VirtualProtect(src, len, PAGE_READWRITE, &dwBack);
memcpy(jmp, src, len);
jmp += len;
jmp[0] = 0xE9;
*(DWORD*)(jmp+1) = (DWORD)(src+len - jmp) - 5;
src[0] = 0x90; //50
src[1] = 0x90; // 58
src[2] = 0xE9;
*(DWORD*)(&src[3]) = (DWORD)(dst - src) - 7;
for (int i=7; i<len; i++) src = 0x90;
VirtualProtect(src, len, dwBack, &dwBack);
return (jmp-len);
}
HRESULT WINAPI myPresent ( LPDIRECT3DDEVICE8 pDevice, CONST RECT* pSourceRect, CONST RECT* pDestRect, HWND hDestWindowOverride, CONST RGNDATA* pDirtyRegion )
{
_asm pushad;
Sleep(100);
_asm popad;
return pPresent( pDevice, pSourceRect, pDestRect, hDestWindowOverride, pDirtyRegion );
}
bool bCompare(const BYTE* pData, const BYTE* bMask, const char* szMask)
{
for(;*szMask;++szMask,++pData,++bMask)
if(*szMask=='x' && *pData!=*bMask )
return false;
return (*szMask) == NULL;
}
DWORD FindPattern(DWORD dwAddress,DWORD dwLen,BYTE *bMask,char * szMask)
{
for(DWORD i=0; i < dwLen; i++)
if( bCompare( (BYTE*)( dwAddress+i ),bMask,szMask) )
return (DWORD)(dwAddress+i);
return 0;
}
int hookPresent()
{
DWORD* VTableHook = 0;
DWORD hD3D8 = (DWORD)GetModuleHandle("d3d8.dll");
DWORD VIRTUALTABLE = FindPattern(hD3D8, 0x128000, (PBYTE)"\xC7\x06\x00\x00\x00\x00\x89\x86\x00\x00\x00\x00\x89\x86", "xx????xx????xx");
memcpy(&VTableHook, (void*)(VIRTUALTABLE+2), 4);
DWORD dwPresent = VTableHook[15];
pPresent = (oPresent)DetourFunc((PBYTE)dwPresent, (PBYTE)myPresent, 7);
return 0;
}
原理就是找到d3d8.dll的入口，搜索特征码，找到Vtalbe(虚函数表)，查表找到需要hook的函数的地址，然后hook
这个比较简单，不需要在游戏启动的时候通过COM的方式取得地址，相对难度要简单得多
需要hook D3D其它函数的可以查一下有关资料，看看相关的函数在虚函数表的位置，然后hook就可以了如果要hook DX9,改对应的特征码就可以了。