Various D3D Hooking Methods

社区服务
高级搜索
猴岛论坛CSGO反恐精英CS作弊器交流讨论Various D3D Hooking Methods
发帖 回复
正序阅读 最近浏览的帖子最近浏览的版块
0个回复

Various D3D Hooking Methods

楼层直达
cheetahcs

ZxID:1226181

等级: 中校
Amazing......
举报 只看楼主 使用道具 楼主   发表于: 2007-07-11 0

There are 2 very direct ways i know very to hook OpenGL. They both effectivley do the same thing but not entirly.
To be honest i prefer the first way which uses creating and storing and so on which i will show you a couple lines down.

The first way is the way pGL Hackbase and some other hack bases uses. They use creation, storage and hooking of the OGL
functions..

Here is how we are going to hook pure OpenGL functions which can be used in about any game that uses OGL. Most games
now use Direct3D/DirectX so this is *kind of* obsolete.

First we need some includes.

Code:
//-- Bascially what yyou need to include in any hack or C++ project you make xD
#include <windows.h>
#include <mmsystem.h>
#include <memory.h>
#include <vector>
#include <string>
#include <tlhelp32.h>

//-- Input/output
#include <fstream>
#include <iostream>

//-- This holds the GL functions we are going to hook
#include <gl\gl.h>
#include <gl\glu.h>
#include <gl\glaux.h>
So now we have the needed included files from your MSVC++ includes folder lets begin.

underneath the includes this is what we do next to create the OGL offset creations.

Code:
#define PTR_CREATE(glPrt) FARPROC pOriginal_##glPtr;
//--
PTR_CREATE(glBegin) //-- As you can tell this is the function we are going to be hooking.... (glBegin)
//--
This creates the offset storage for the OGL functions.

Now we store the original while we hook them (or intercept them, whichever you understand better)

Code:
#define PTR_STORE (function) \
pOriginal_##function = (FARPROC)(GetProcAddress(GetModuleHandle("opengl32.dll"),#function)); \
if (*pOriginal_##function == NULL) \
pResult = false;
//---
bool Storage(void)
{
bool pReseult = true;
//--
PTR_STORE(glBegin)
//--
return pResult;
}
//--
Now create the proper functions with the proper arguments...example being

Code:
void MyHooked_glBegin (mode) //--For MyHooked_ information see below
{
/* Do
your

    code
here */


__asm
{
push mode
call dword ptr [pOriginal_glBegin]
}
}
Now when hooking OGL Functions this way when you use masm you need to call the arguments in reverse order. For instance
if viewport has glViewport ( GLint x, GLint y, GLsizei width, GLsizei height ) you need to do it like

Code

__asm
{
push height
push width
push y
push x
call dword ptr [pOriginal_glViewport]
}
Ok now that we have the functions and there arguements we move below the function we made (being glBegin). Now is where
we do the complete hooking of the OGL functions. This is where the MyHooked_ comes in

Code:
#define HOOK_APPLY(func_name) if(!lstrcmp(lpProcName,#func_name)) { \
*pProc = (FARPROC) &MyHooked_##func_name; \
return; }
//---
void ApplyOpenGLHook (FARPROC* pProc,LPCSTR lpProcName)
{
HOOK_APPLY(glBegin)
}
This only shows you how to hook glBegin....look around the forums for a complete list of the OGL functions and their
arguments.

//-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

That is one way down. Here is the next. Its basically the same thing but to some is a little more unorganized. I kind of like it
but i find the PTR way a bit more easy to hook OGL functions. This gets confusing so pay attention.

This is the way to hook using detours.

First we need includes...

Code:
#include <windows.h>
#include <gl/gl.h>
#include <gl/glu.h>
#include <gl/glaux.h>
#include <detours.h>
#include <iostream.h>
#include <fstream.h>
#include <math.h>
I will attach the detours files for downloading. Once agian i will only show you how to hook glBegin, you can figure the rest out
on your own.

This is pretty self exaplanitory, all we are doing is redirecting the calls to the OGL functions from the HL or any other game
engine or OGL based program and redirecting them to the ones we have hooked which have the 'code' in it (code being like
disabling depth test before the original glBegin function is called to give us an XQZ wallhack).
typedef void      (APIENTRY*FUNC_GLBEGIN) (GLenum mode);
This is where we redirect to our OGL glBegin function.
FUNC_GLBEGINx3x_glBegin = NULL;
This allows the redirection...

This is where we make our NEW glBegin function...likes so
Code:
void APIENTRY Hooking_glBegin(GLenum mode)
{


//-- As you can see we do the code BEFORE the original OGL glBegin function is called
x3x_glBegin(mode);
}
Heres the actual hooking being done. This is where and why it is a bit unorganized...in my opinion.
BOOL APIENTRY DllMain(HANDLE hModule, DWORD rfcall, LPVOID lpReserved)
{
switch (rfcall)
{
case DLL_PROCESS_ATTACH: {
     DisableThreadLibraryCalls((HMODULE)hModule);
x3x_glBegin = (FUNC_GLBEGIN) DetourFunction((PBYTE)DetourFindFunction("OpenGl32.dll", "glBegin"), (PBYTE)Hooking_glBegin);
}
break;
//  Follow example below

//    DetourRemove((PBYTE)x3x_glFunc,(PBYTE)Hooking_glBe  gin); ---- This is where we are removing the redirection to
//    allow the OGL glBegin to pass through BUT now with our code inside...



case DLL_PROCESS_DETACH:
      DetourRemove((PBYTE)x3x_glBegin,(PBYTE)Hooking_glB  egin);
    break;
   }
    return TRUE;
}
Hope this helps for people wanting to leanr some things.

The files needed are below and i may do examples if i am bored and attach them. Below you will find the detours files needed
for using the second method of OGL hooking.

I have only shown how to hook glBegin, you can find another complete list elsewhere on the forums.

I will update this tomorrw or later tonight
(mind you all i did this on a 2 hour bus ride back from a baseball game....)

FOR REDGHOST AND OTHERS THAT DONT HAVE COMMON SENSE : I DID NOT WRITE THESE METHODS THEY WERE ALREADY DONE I JUST WROTE A TUT FOR PEOPLE WHO WERE BUGGING ME
WE COME HARDER,YOU GO PRO.
« 返回列表
发帖 回复