#include "SunClientPrecompiledHeader.h" #include "XiaoMiFunc.h" #include "Memory.h" DWORD JMPfilterInfo = 0x19498; // 00779CFC 85C9 TEST ECX, ECX DWORD JMPnormalInfo = 0x1952C; // 00779CFC 85C9 TEST ECX, ECX DWORD JMPspecularMapInfo = 0x195C0; DWORD JMPdiffuseMapInfo = 0x19657; DWORD JMPInternalMapInfo = 0x196EB; DWORD JMPRenderInfo = 0x212EA; DWORD ReadNameCall = 0x2769B; // update DWORD FilterMapInfo = 0x19484; // update; DWORD NormalMapInfo = 0x19518; DWORD SpecularMapInfo = 0x195AC; DWORD DiffuseMapInfo = 0x19643; DWORD InternalMapInfo = 0x196D7; DWORD RenderInfo = 0x212C7; DWORD unk = 0; DWORD Read = 0x275FE; // update DWORD jmpAniWhile = 0x3A49; DWORD AniBoneInfo = 0x3A49; DWORD JMPAniInfo = 0x3D39; // Effect.dll DWORD ReadEffect = 0x34FA9; DWORD JmpCreateInfo = 0x10822; DWORD CreateInfo = 0x10808; DWORD JmpChangeInfo = 0x1227F; DWORD ChangeInfo = 0x12263; DWORD JMPVisualInfoSprite = 0x12950; DWORD VisualInfoSprite = 0x12939; DWORD JMPVisualInfoMesh = 0x12AAA; DWORD VisualInfoMesh = 0x12A93; DWORD JMPVisualInfoDecal = 0x12BB6; DWORD VisualInfoDecal = 0x12B9F; int test1 = 0; char testByte = 0; int testArray[7] = {0}; int testArray2[5] = {0}; WORD WzuVersion = 0; char* effVer; DWORD temp = 0; int unkSize = 0; int size2 = 0; int changeInfoCount = 0; Naked(LoadNewAni) { __asm { mov eax, dword ptr ss : [ebp + 0x8] mov eax, dword ptr ds : [eax + 0x120] cmp eax, 0x82 jae load130 jmp JMPAniInfo load130: push 0x4 lea eax, unkSize push eax mov ecx, dword ptr ss : [ebp + 0x8] call Read } for (int i = 0; i < unkSize; ++i) { __asm { push 0x4 lea eax, size2 push eax mov ecx, dword ptr ss : [ebp + 0x8] call Read } if (size2) { for (int a = 0; a < size2; ++a) { __asm { push 0x4 lea eax, test1 push eax mov ecx, dword ptr ss : [ebp + 0x8] call Read push 0x4 lea eax, test1 push eax mov ecx, dword ptr ss : [ebp + 0x8] call Read } } } } __asm{ jmp JMPAniInfo } } Naked(filterInfo) { __asm { add esp, 0xC push 0x0 lea eax, dword ptr ss : [ebp - 0xBC] push eax mov ecx, dword ptr ss : [ebp + 0x8] call ReadNameCall cmp dword ptr ss : [ebp - 0x29C] , 0x96 jae loadVersion150 jmp JMPfilterInfo loadVersion150 : push 0x4 lea eax, test1 push eax mov ecx, dword ptr ss : [ebp + 0x8] call Read jmp JMPfilterInfo } } Naked(normalInfo) { __asm { add esp, 0xC push 0x0 lea eax, dword ptr ss : [ebp - 0x104] push eax mov ecx, dword ptr ss : [ebp + 0x8] call ReadNameCall cmp dword ptr ss : [ebp - 0x2A0] , 0x96 jae loadVersion150 jmp JMPnormalInfo loadVersion150 : push 0x4 lea eax, test1 push eax mov ecx, dword ptr ss : [ebp + 0x8] call Read jmp JMPnormalInfo } } Naked(specularMapInfo) { __asm { add esp, 0xC push 0x0 lea eax, dword ptr ss : [ebp - 0x14C] push eax mov ecx, dword ptr ss : [ebp + 0x8] call ReadNameCall cmp dword ptr ss : [ebp - 0x2A4] , 0x96 jae loadVersion150 jmp JMPspecularMapInfo loadVersion150 : push 0x4 lea eax, test1 push eax mov ecx, dword ptr ss : [ebp + 0x8] call Read jmp JMPspecularMapInfo } } Naked(diffInfo) { __asm { add esp, 0xC push 0x0 lea eax, dword ptr ss : [ebp - 0x194] push eax mov ecx, dword ptr ss : [ebp + 0x8] call ReadNameCall cmp dword ptr ss : [ebp - 0x2A8] , 0x96 jae loadVersion150 jmp JMPdiffuseMapInfo loadVersion150 : push 0x4 lea eax, test1 push eax mov ecx, dword ptr ss : [ebp + 0x8] call Read jmp JMPdiffuseMapInfo } } Naked(internalMap) { __asm { add esp, 0xC push 0x0 lea eax, dword ptr ss : [ebp - 0x1dc] push eax mov ecx, dword ptr ss : [ebp + 0x8] call ReadNameCall cmp dword ptr ss : [ebp - 0x2AC] , 0x96 jae loadVersion150 jmp JMPInternalMapInfo loadVersion150 : push 0x4 lea eax, test1 push eax mov ecx, dword ptr ss : [ebp + 0x8] call Read jmp JMPInternalMapInfo } } Naked(renderInfo) { __asm { cmp dword ptr ss : [ebp - 0x150] , 0x7C jb RenderOne push 0x4 lea eax, dword ptr ss : [ebp - 0x9C] push eax mov ecx, dword ptr ss : [ebp + 0x8] call Read cmp dword ptr ds : [ebp - 0x150] , 0x8c jb RenderTwo push 0x4 lea eax, test1 push eax mov ecx, dword ptr ss : [ebp + 0x8] call Read jmp JMPRenderInfo RenderOne : and dword ptr ss : [ebp - 0x9C] , 0 jmp JMPRenderInfo RenderTwo : and unk, 0x0 jmp JMPRenderInfo } } void initHook(){ DWORD FileAccessHandle = (DWORD)GetModuleHandleA("3DFileAccess.dll"); if (FileAccessHandle) { ReadNameCall += FileAccessHandle; Read += FileAccessHandle; JMPfilterInfo += (DWORD)FileAccessHandle; JMPnormalInfo += (DWORD)FileAccessHandle; JMPspecularMapInfo += (DWORD)FileAccessHandle; JMPdiffuseMapInfo += (DWORD)FileAccessHandle; JMPInternalMapInfo += (DWORD)FileAccessHandle; JMPRenderInfo += (DWORD)FileAccessHandle; JMPAniInfo += (DWORD)FileAccessHandle; jmpAniWhile += (DWORD)FileAccessHandle; // MessageBoxA(0, addr, addr, 0); SetByte((LPVOID)(FileAccessHandle + 0x18414), 0x96); SetByte((LPVOID)(FileAccessHandle + 0x1839C), 0x96); SetByte((LPVOID)(FileAccessHandle + 0x4cad), 0x82); SetRange((LPVOID)(FileAccessHandle + FilterMapInfo), 12, ASM::NOP); SetOp((LPVOID)(FileAccessHandle + FilterMapInfo), (LPVOID)filterInfo, ASM::JMP); SetRange((LPVOID)(FileAccessHandle + NormalMapInfo), 12, ASM::NOP); SetOp((LPVOID)(FileAccessHandle + NormalMapInfo), (LPVOID)normalInfo, ASM::JMP); SetRange((LPVOID)(FileAccessHandle + SpecularMapInfo), 12, ASM::NOP); SetOp((LPVOID)(FileAccessHandle + SpecularMapInfo), (LPVOID)specularMapInfo, ASM::JMP); SetRange((LPVOID)(FileAccessHandle + DiffuseMapInfo), 12, ASM::NOP); SetOp((LPVOID)(FileAccessHandle + DiffuseMapInfo), (LPVOID)diffInfo, ASM::JMP); SetRange((LPVOID)(FileAccessHandle + InternalMapInfo), 12, ASM::NOP); SetOp((LPVOID)(FileAccessHandle + InternalMapInfo), (LPVOID)internalMap, ASM::JMP); SetRange((LPVOID)(FileAccessHandle + RenderInfo), 12, ASM::NOP); SetOp((LPVOID)(FileAccessHandle + RenderInfo), (LPVOID)renderInfo, ASM::JMP); SetRange((LPVOID)(FileAccessHandle + AniBoneInfo), 5, ASM::NOP); SetOp((LPVOID)(FileAccessHandle + AniBoneInfo), (LPVOID)LoadNewAni, ASM::JMP); } else { MessageBoxA(0, "Error!", "Error!FileAccess", 0); } }