[Tutorial] Make D3D menu HACK

Tools yang dibutuhkan :
* VC++ 2010
* Microsoft DirectX 9.0 SDK (Summer 2004)

Okey setelah dapet Alat perangnya.

Langkah Pertama :

1. Jalankan Visual C++ 2010 Express Edition, Setelah itu buat new Project
2. Pilih Visual C++, Empty Project dan namakan dengan zenix D3Dbase.

3. Ok Project telah dibuat, Setelah itu buat Header setelah itu Klik pada Project dan pilih Add New Item.

Pilih Header File dan Namai dengan zenixMenuClass.h dan isikan code berikut :

zenixMenuClass.h

//==================================================================
// This file is part of zenixbase d3d v1
// (c) copyright zenix 2010
// special thanks to: 
//   Njank-Njutz
//   //mcz yang selalu dukung gw
//   nyit-nyit.net
//==================================================================
#include "Functions.h"

typedef struct{
        int index;
        char * title;
        int *hack;
        int hackmaxval;
        int hacktype;
        DWORD HCOLOR;
}ITEM;

class zenixMenu {
        public:
        LPDIRECT3DDEVICE9 pDevice;
        LPD3DXFONT pFont;

        int hackcount;
        int selector;
        int x,y,w,h;
        DWORD COLOR;

        ITEM HACKITEM[99];
        char hackrval[256];

        void CreateItem(int index, char * title, int *hack,int hackmaxval=1,int hacktype=0);
        void BuildMenu(char * menuname, int x, int y, int h, int w, DWORD TITLECOL, DWORD BACKCOLOR, DWORD BORDERCOLOR, LPDIRECT3DDEVICE9 pDevice);
        void RenderMenu();
};

typedef HRESULT ( WINAPI* oReset )( LPDIRECT3DDEVICE9 pDevice, D3DPRESENT_PARAMETERS* pPresentationParameters );
typedef HRESULT (WINAPI* oEndScene)(LPDIRECT3DDEVICE9 pDevice);

//Colors A,R,G,B Gan Silahkan dipakai untuk membuat Chams
#define RED D3DCOLOR_ARGB(255, 255, 0, 0)
#define GREEN D3DCOLOR_ARGB(255, 0, 255, 0)
#define BLUE D3DCOLOR_ARGB(255, 0, 0, 255)
#define WHITE D3DCOLOR_ARGB(255, 255, 255, 255)
#define BLACK D3DCOLOR_ARGB(255, 0, 0, 0)
#define YELLOW D3DCOLOR_ARGB(255, 255, 255, 0)
#define TEAL D3DCOLOR_ARGB(255, 0, 255, 255)
#define PINK D3DCOLOR_ARGB(255, 255, 240, 0)
#define ORANGE D3DCOLOR_ARGB(255, 255, 132, 0)
#define LIME D3DCOLOR_ARGB(255, 198, 255, 0)
#define SKYBLUE D3DCOLOR_ARGB(255, 0, 180, 255)
#define MAROON D3DCOLOR_ARGB(255, 142, 30, 0)
#define LGRAY D3DCOLOR_ARGB(255, 174, 174, 174) 
#define DGRAY D3DCOLOR_ARGB(255, 71, 65, 64) 
#define BROWN D3DCOLOR_ARGB(255, 77, 46, 38)
#define SHIT D3DCOLOR_ARGB(255, 74, 38, 38)

4. Setelah itu buat Header lagi dan Beri Nama dengan Functions.h dan Isi dengan code berikut :

Functions.h

//==================================================================
// This file is part of zenixbase d3d v1
// (c) copyright zenix 2010
// special thanks to: 
//   Njank-Njutz
//   //mcz yang selalu dukung gw
//   nyit-nyit.net
//==================================================================

#include "SystemIncludes.h"

void PrintText(char pString[], int x, int y, D3DCOLOR col, ID3DXFont *font)
{
    RECT FontRect = { x, y, x+500, y+30 };
    font->DrawText( NULL, pString, -1, &FontRect, DT_LEFT | DT_WORDBREAK, col);
}

void FillRGB( int x, int y, int w, int h, D3DCOLOR color, IDirect3DDevice9* pDevice )
{
    if( w < 0 )w = 1;
    if( h < 0 )h = 1;
    if( x < 0 )x = 1;
    if( y < 0 )y = 1;

    D3DRECT rec = { x, y, x + w, y + h };
    pDevice->Clear( 1, &rec, D3DCLEAR_TARGET, color, 0, 0 );
}

void DrawBorder( int x, int y, int w, int h, int px, D3DCOLOR BorderColor, IDirect3DDevice9* pDevice )
{
    FillRGB( x, (y + h - px), w, px,    BorderColor, pDevice );
    FillRGB( x, y, px, h,                BorderColor, pDevice );
    FillRGB( x, y, w, px,                BorderColor, pDevice );
    FillRGB( (x + w - px), y, px, h,    BorderColor, pDevice );
}

void DrawBox( int x, int y, int w, int h, D3DCOLOR BoxColor, D3DCOLOR BorderColor, IDirect3DDevice9* pDevice )
{
    FillRGB( x, y, w, h,        BoxColor, pDevice );
    DrawBorder( x, y, w, h, 1,    BorderColor, pDevice );
}  

bool isMouseinRegion(int x1, int y1, int x2, int y2) 
{
        POINT cPos;
        GetCursorPos(&cPos);
        if(cPos.x > x1 && cPos.x < x2 && cPos.y > y1 && cPos.y < y2){
                return true;
        } else {
                return false;
        }
}

bool bCompare(const BYTE* pData, const BYTE* bMask, const char* szMask)
{
        for(;*szMask;++szMask,++pData,++bMask)
                if(*szMask=='x' && *pData!=*bMask)  
                        return 0;
        return (*szMask) == NULL;
}

DWORD FindPattern(DWORD dwAddress,DWORD dwLen,BYTE *bMask,char * szMask)
{
        for(DWORD i=0; i<dwLen; i++)
                if (bCompare((BYTE*)(dwAddress+i),bMask,szMask))  
                        return (DWORD)(dwAddress+i);
        return 0;
}

void *DetourFunction (BYTE *src, const BYTE *dst, const int len)
{
    BYTE *jmp;
    DWORD dwback;
    DWORD jumpto, newjump;

    VirtualProtect(src,len,PAGE_READWRITE,&dwback);
    
    if(src[0] == 0xE9)
    {
        jmp = (BYTE*)malloc(10);
        jumpto = (*(DWORD*)(src+1))+((DWORD)src)+5;
        newjump = (jumpto-(DWORD)(jmp+5));
        jmp[0] = 0xE9;
       *(DWORD*)(jmp+1) = newjump;
        jmp += 5;
        jmp[0] = 0xE9;
       *(DWORD*)(jmp+1) = (DWORD)(src-jmp);
    }
    else
    {
        jmp = (BYTE*)malloc(5+len);
        memcpy(jmp,src,len);
        jmp += len;
        jmp[0] = 0xE9;
       *(DWORD*)(jmp+1) = (DWORD)(src+len-jmp)-5;
    }
    src[0] = 0xE9;
   *(DWORD*)(src+1) = (DWORD)(dst - src) - 5;

    for(int i = 5; i < len; i++)
        src[i] = 0x90;
    VirtualProtect(src,len,dwback,&dwback);
    return (jmp-len);
}

5. Buat Header lagi beri Nama SystemIncludes.h dan Isikan code berikut :

SystemIncludes.h

//==================================================================
// This file is part of zenixbase d3d v1
// (c) copyright zenix 2010
// special thanks to: 
//   Njank-Njutz
//   //mcz yang selalu dukung gw
//   nyit-nyit.net
//==================================================================

#include <Windows.h>
#include <stdio.h>
#include <d3d9.h>
#include <d3dx9.h>

#pragma comment(lib,"d3dx9.lib")

6. Klik pada Source Files kemudian Add New Item pilih C++ File (.cpp) Beri Nama D3dbase.cpp Isikan code berikut :

D3dbase.cpp

//==================================================================
// This file is part of zenixbase d3d v1
// (c) copyright zenix 2010
// special thanks to: 
//   Njank-Njutz
//   //mcz yang selalu dukung gw
//   nyit-nyit.net
//==================================================================
#include "zenixMenuClass.h"

oReset pReset;
oEndScene pEndScene;

zenixMenu dMenu;

LPDIRECT3DDEVICE9 g_pDevice = 0;
//Mengatur Offset Font Menu Hack
int xFontOffSet = 15;

int hackopt1;
int MenuHeight = 10;

int show=1;

int b = 0;
//==================================================================
//Menu HACK
int hack1 = 0;
int hack2 = 0;
int hack3 = 0;
int hack4 = 0;
int hack5 = 0;
//==================================================================

void zenixMenu::CreateItem(int index, char * title, int *hack, int hackmaxval,int hacktype)
{
        hackcount++;
        HACKITEM[hackcount].index = index;
        HACKITEM[hackcount].hack = hack;
        HACKITEM[hackcount].hackmaxval = hackmaxval;
        HACKITEM[hackcount].hacktype = hacktype;
        // Mengatur tinggi rendahnya Menu Hack
        PrintText(title, xFontOffSet, index*15,HACKITEM[hackcount].HCOLOR,pFont); 
}

void zenixMenu::BuildMenu(char * menuname, int x, int y, int h, int w, DWORD TITLECOL, DWORD BACKCOLOR, DWORD BORDERCOLOR, LPDIRECT3DDEVICE9 pDevice)
{
        if(GetAsyncKeyState(VK_INSERT)&1)show=(!show); //Memunculkan Menu HACK (INSERT)
        if(!show) {
                DrawBox(0,0, w, 20, BACKCOLOR, BORDERCOLOR, pDevice);
                PrintText(menuname, 5, 2, TITLECOL, pFont);
                return;
        }

        DrawBox(x,y, w, h, BACKCOLOR, BORDERCOLOR, pDevice); // Sesuaikan dengan Base Menu HACK
        PrintText(menuname, x+10, y+2, TITLECOL, pFont);
        CreateItem(1,"Ammo", &hack1);
        CreateItem(2,"Recoil", &hack2); 
        CreateItem(3,"Wallhack", &hack3);
        CreateItem(4,"Chams", &hack4);
        CreateItem(5,"Apa aja deh", &hack5);
        RenderMenu();
}


void zenixMenu::RenderMenu() //Hotkey menu
{
        if(GetAsyncKeyState(VK_DOWN)&1) 
                        selector++;

        if(GetAsyncKeyState(VK_UP)&1)
                if(selector > 1)
                        selector--;

        if (GetAsyncKeyState(VK_RIGHT)<0){
                for(int i=0;i < (hackcount+1);i++){
           if(selector == HACKITEM[i].index){
                           if(*HACKITEM[i].hack < HACKITEM[i].hackmaxval)
                                        *HACKITEM[i].hack += 1;

                                        }
                        }
        }

        if (GetAsyncKeyState(VK_LEFT)<0){
                for(int i=0;i < (hackcount+1);i++){
           if(selector == HACKITEM[i].index){
                           *HACKITEM[i].hack = 0;
                           Sleep(200);
                                }
                        }
        }
        
        for(int i=0;i < (hackcount+1);i++){
                if(selector == HACKITEM[i].index)
                        HACKITEM[i].HCOLOR = GREEN;
                else
                        HACKITEM[i].HCOLOR = RED;
        }

        for(int i=1; i<(hackcount+1); i++){
                if(HACKITEM[i].hacktype == 0){
                if(*HACKITEM[i].hack == 1) 

                // Mengatur tinggi rendahnya Menu Hotkey
                PrintText("On", xFontOffSet+100, HACKITEM[i].index*15,WHITE,pFont);
         else 
                PrintText("Off", xFontOffSet+100, HACKITEM[i].index*15,RED,pFont);
        
                }
        }

        if(selector < 1)
                selector = 1;

        if(selector > hackcount)
                selector = 1;

        hackcount = 0;
}

void TestThread() //Memunculkan texk jika ON/OFF
{
        if( hack1 == 1)
                PrintText("Jika Ammo [ON] text akan berubah warna", 30, 200, GREEN, dMenu.pFont);
        else
                PrintText("Jika Ammo [ON] text akan berubah warna", 30, 200, RED, dMenu.pFont);
} //Sesuaikan saja

void ReFont(LPDIRECT3DDEVICE9 pDevice) //Untuk penggantian font
{
    if (g_pDevice != pDevice)
    {
        g_pDevice = pDevice;
        try
        {
            if (dMenu.pFont != 0)
                dMenu.pFont->Release();
        } catch (...) {}
        dMenu.pFont = 0;
        D3DXCreateFontA(pDevice, 14, 0, FW_BOLD, 0, 0, DEFAULT_CHARSET, OUT_TT_ONLY_PRECIS, PROOF_QUALITY, DEFAULT_PITCH | FF_DONTCARE, "Arial", &dMenu.pFont ); 
    }
}

HRESULT WINAPI Reset(IDirect3DDevice9* pDevice, D3DPRESENT_PARAMETERS* pPresentationParameters )
{
        dMenu.pFont->OnLostDevice();

        HRESULT hRet = pReset(pDevice, pPresentationParameters);

        dMenu.pFont->OnResetDevice();

        return hRet;
}

// Menu TITLE
HRESULT WINAPI EndScene(LPDIRECT3DDEVICE9 pDevice)
{
        ReFont(pDevice);
        dMenu.BuildMenu("Nyit-nyit.net 2010",0,0,190,200,RED,BLACK,GREEN,pDevice);
        TestThread();
        return pEndScene(pDevice);
}



int D3Dinit(void)
{
        DWORD           hD3D, adr, *vtbl;
        hD3D=0;
        do {
                hD3D = (DWORD)GetModuleHandle("d3d9.dll");
                Sleep(10);
        } while(!hD3D); 
        adr = FindPattern(hD3D, 0x128000, (PBYTE)"\xC7\x06\x00\x00\x00\x00\x89\x86\x00\x00\x00\x00\x89\x86", "xx????xx????xx");
        if (adr) {
                memcpy(&vtbl,(void *)(adr+2),4);
                pReset    = (oReset)    DetourFunction((PBYTE)vtbl[16]   , (PBYTE)Reset   ,5);
                pEndScene = (oEndScene) DetourFunction((PBYTE)vtbl[42], (PBYTE)EndScene,5);
        }
        return 0;
}

BOOL WINAPI DllMain ( HMODULE hDll, DWORD dwReason, LPVOID lpReserved )
{
        DisableThreadLibraryCalls(hDll);

        if ( dwReason == DLL_PROCESS_ATTACH ) {

                CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)D3Dinit, NULL, NULL, NULL);
        }
        if( dwReason == DLL_PROCESS_DETACH)     {
                dMenu.pFont->Release();
        }
        return TRUE;
}

Screenshot :

7. Kemudian Save All Project. Setelah project telah di Save lalu Compile/Start Debugging.
8. Jangan lupa rubah Properties Project rubah Application (.exe) menjadi Dinamic Library (.dll)

Screenshot :

Pada Fungtions.h void *DetourFunction

Fungtions.h

void *DetourFunction (BYTE *src, const BYTE *dst, const int len)
{
    BYTE *jmp;
    DWORD dwback;
    DWORD jumpto, newjump;

    VirtualProtect(src,len,PAGE_READWRITE,&dwback);
    
    if(src[0] == 0xE9)
    {
        jmp = (BYTE*)malloc(10);
        jumpto = (*(DWORD*)(src+1))+((DWORD)src)+5;
        newjump = (jumpto-(DWORD)(jmp+5));
        jmp[0] = 0xE9;
       *(DWORD*)(jmp+1) = newjump;
        jmp += 5;
        jmp[0] = 0xE9;
       *(DWORD*)(jmp+1) = (DWORD)(src-jmp);
    }
    else
    {
        jmp = (BYTE*)malloc(5+len);
        memcpy(jmp,src,len);
        jmp += len;
        jmp[0] = 0xE9;
       *(DWORD*)(jmp+1) = (DWORD)(src+len-jmp)-5;
    }
    src[0] = 0xE9;
   *(DWORD*)(src+1) = (DWORD)(dst - src) - 5;

    for(int i = 5; i < len; i++)
        src[i] = 0x90;
    VirtualProtect(src,len,dwback,&dwback);
    return (jmp-len);
}

Bisa kalian ganti dengan :

void *DetourFunction (BYTE *src, const BYTE *dst, const int len)
{
                BYTE *jmp = (BYTE*)malloc(len+5);
        DWORD dwBack;

        VirtualProtect(src, len, PAGE_EXECUTE_READWRITE, &dwBack);
        memcpy(jmp, src, len);  
        jmp += len;
        jmp[0] = 0xE9;
        *(DWORD*)(jmp+1) = (DWORD)(src+len - jmp) - 5;
        src[0] = 0xE9;
        *(DWORD*)(src+1) = (DWORD)(dst - src) - 5;
        for (int i=5; i<len; i++)  src[i]=0x90;
        VirtualProtect(src, len, dwBack, &dwBack);
        return (jmp-len);
}

Screenshot Hasil :