d3d EndScene x64Detour hook fails at "[+] Info: Trampoline Jmp Tbl:"

[UCFoxi]

PLH::CapstoneDisassembler dis(PLH::Mode::x64); PLH::x64Detour detour((uint64_t)pInterface[42], (uint64_t)hkEndScene, (uint64_t*)&EndScene, dis); detour.hook();

crash game:

[+] pInterface[42] Addr: 0x7ffd2350d3a0 [+] Info: Original function: 7ffd2350d3a0 [2]: 40 57 push rdi 7ffd2350d3a2 [4]: 48 83 ec 40 sub rsp, 0x40 7ffd2350d3a6 [9]: 48 c7 44 24 28 fe ff ff ff mov qword ptr [rsp + 0x28], -2 7ffd2350d3af [5]: 48 89 5c 24 50 mov qword ptr [rsp + 0x50], rbx 7ffd2350d3b4 [3]: 48 8b f9 mov rdi, rcx 7ffd2350d3b7 [3]: 48 8b c1 mov rax, rcx 7ffd2350d3ba [4]: 48 8d 51 08 lea rdx, [rcx + 8] 7ffd2350d3be [3]: 48 f7 d8 neg rax 7ffd2350d3c1 [3]: 48 1b db sbb rbx, rbx 7ffd2350d3c4 [3]: 48 23 da and rbx, rdx 7ffd2350d3c7 [5]: 48 89 5c 24 30 mov qword ptr [rsp + 0x30], rbx 7ffd2350d3cc [5]: 83 64 24 38 00 and dword ptr [rsp + 0x38], 0 7ffd2350d3d1 [4]: 83 7b 28 00 cmp dword ptr [rbx + 0x28], 0 7ffd2350d3d5 [6]: 0f 85 67 9b 03 00 jne 0x7ffd23546f42 -> 7ffd23546f42 7ffd2350d3db [3]: 8b 47 4c mov eax, dword ptr [rdi + 0x4c] 7ffd2350d3de [3]: 83 e0 02 and eax, 2 7ffd2350d3e1 [2]: 84 c0 test al, al 7ffd2350d3e3 [6]: 0f 85 68 9b 03 00 jne 0x7ffd23546f51 -> 7ffd23546f51 7ffd2350d3e9 [6]: 8b 87 0c 41 00 00 mov eax, dword ptr [rdi + 0x410c] 7ffd2350d3ef [2]: a8 01 test al, 1 7ffd2350d3f1 [6]: 0f 84 6e 9b 03 00 je 0x7ffd23546f65 -> 7ffd23546f65 7ffd2350d3f7 [7]: f6 87 08 41 00 00 04 test byte ptr [rdi + 0x4108], 4 7ffd2350d3fe [6]: 0f 85 94 9b 03 00 jne 0x7ffd23546f98 -> 7ffd23546f98

[+] Info: Prologue to overwrite: 7ffd2350d3a0 [2]: 40 57 push rdi 7ffd2350d3a2 [4]: 48 83 ec 40 sub rsp, 0x40 7ffd2350d3a6 [9]: 48 c7 44 24 28 fe ff ff ff mov qword ptr [rsp + 0x28], -2 7ffd2350d3af [5]: 48 89 5c 24 50 mov qword ptr [rsp + 0x50], rbx

[+] Info: Jmp To Prol: 1e048a3f204 [6]: ff 25 46 00 00 00 jmp [1e048a3f250] ->7ffd2350d3b4 1e048a3f250 [8]: b4 d3 50 23 fd 7f 00 00 dest holder

[+] Info: Trampoline: 1e048a3f1f0 [2]: 40 57 push rdi 1e048a3f1f2 [4]: 48 83 ec 40 sub rsp, 0x40 1e048a3f1f6 [9]: 48 c7 44 24 28 fe ff ff ff mov qword ptr [rsp + 0x28], -2 1e048a3f1ff [5]: 48 89 5c 24 50 mov qword ptr [rsp + 0x50], rbx 1e048a3f204 [6]: ff 25 46 00 00 00 jmp qword ptr [rip + 0x46] -> 1e048a3f250 1e048a3f20a [3]: 30 42 e0 xor byte ptr [rdx - 0x20], al 1e048a3f20d [2]: 01 00 add dword ptr [rax], eax 1e048a3f20f [2]: 00 01 add byte ptr [rcx], al 1e048a3f211 [2]: 00 00 add byte ptr [rax], al 1e048a3f213 [2]: 00 fc add ah, bh 1e048a3f215 [2]: 7f 00 jg 0x1e048a3f217 -> 1e048a3f217 1e048a3f217 [2]: 00 00 add byte ptr [rax], al 1e048a3f219 [2]: 00 00 add byte ptr [rax], al 1e048a3f21b [2]: 00 00 add byte ptr [rax], al 1e048a3f21d [2]: 00 00 add byte ptr [rax], al 1e048a3f21f [2]: 00 00 add byte ptr [rax], al 1e048a3f221 [2]: 00 00 add byte ptr [rax], al 1e048a3f223 [2]: 00 01 add byte ptr [rcx], al 1e048a3f225 [2]: 00 00 add byte ptr [rax], al 1e048a3f227 [2]: 00 01 add byte ptr [rcx], al 1e048a3f229 [2]: 00 00 add byte ptr [rax], al 1e048a3f22b [2]: 00 00 add byte ptr [rax], al 1e048a3f22d [2]: 00 00 add byte ptr [rax], al 1e048a3f22f [2]: 00 00 add byte ptr [rax], al 1e048a3f231 [2]: 00 00 add byte ptr [rax], al 1e048a3f233 [2]: 00 00 add byte ptr [rax], al 1e048a3f235 [2]: 00 00 add byte ptr [rax], al 1e048a3f237 [2]: 00 00 add byte ptr [rax], al 1e048a3f239 [2]: 00 00 add byte ptr [rax], al 1e048a3f23b [2]: 00 00 add byte ptr [rax], al 1e048a3f23d [2]: 00 00 add byte ptr [rax], al 1e048a3f23f [2]: 00 00 add byte ptr [rax], al 1e048a3f241 [2]: 00 00 add byte ptr [rax], al 1e048a3f243 [2]: 00 00 add byte ptr [rax], al 1e048a3f245 [2]: 00 00 add byte ptr [rax], al 1e048a3f247 [2]: 00 00 add byte ptr [rax], al 1e048a3f249 [2]: 00 00 add byte ptr [rax], al 1e048a3f24b [2]: 00 00 add byte ptr [rax], al 1e048a3f24d [2]: 00 00 add byte ptr [rax], al 1e048a3f24f [7]: 00 b4 d3 50 23 fd 7f add byte ptr [rbx + rdx*8 + 0x7ffd2350], dh 1e048a3f256 [2]: 00 00 add byte ptr [rax], al

[+] Info: Trampoline Jmp Tbl:

any way to get it fixed? *same with Present..

[stevemk14ebr]

I don't see anything obviously incorrect here with how the patch was applied. Please verify that your typedef is correct for hkEndScene (remember there is a hidden this parameter for virtual member functions). If you believe it is correct after inspection then please post the parts of your code relating to this hook, or debug the crash and try to identify the faulting instruction

[UCFoxi]

here is my present one that gives me the same issue:

typedef HRESULT(__stdcall* D3D11PresentHook) (IDXGISwapChain* pSwapChain, UINT SyncInterval, UINT Flags);
D3D11PresentHook pOriginalD3D11PresentHook;

HRESULT __stdcall PresentHook(IDXGISwapChain* pSwapChain, UINT SyncInterval, UINT Flags)
{//effects.PeakEffect().trigger();
    MessageBoxA(0, "called", 0, 0);
    return 0;}

i do return 0 just for testing!

if (FAILED(hr = D3D11CreateDeviceAndSwapChain(NULL,
        D3D_DRIVER_TYPE_HARDWARE,
        NULL,
        0,
        &FeatureLevelsRequested,
        numFeatureLevelsRequested,
        D3D11_SDK_VERSION,
        &sd,
        &swapchain,
        &dev,
        &FeatureLevelsSupported,
        &devcon)))
    {
        std::cout << "[-] Failed to hook Present with VT method." << std::endl;
        return 0;
    }
    DWORD_PTR* pSwapChainVtable = NULL;
    pSwapChainVtable = (DWORD_PTR*)swapchain;
    pSwapChainVtable = (DWORD_PTR*)pSwapChainVtable[0];

PLH::CapstoneDisassembler dis(PLH::Mode::x64);
    PLH::x64Detour detour((uint64_t)pSwapChainVtable[8], (uint64_t)&PresentHook, reinterpret_cast<uint64_t*>(&pOriginalD3D11PresentHook), dis);
    hooked = detour.hook();

    if (!hooked) {
        MessageBoxA(0, "Hook failed!", 0, 0);
    }

some said there are 2x void* args in the start of PresentHook but that dont work... HRESULT __stdcall PresentHook(void* a0, void* a1, IDXGISwapChain* pSwapChain, UINT SyncInterval, UINT Flags)

*it crashes after ~2s at [+] Info: Trampoline Jmp Tbl:

[Mixaill]

some said there are 2x void* args in the start of PresentHook but that dont work...

There is no additional args before this ptr.

Also, you must call original Present function

HRESULT __stdcall PresentHook(IDXGISwapChain* pSwapChain, UINT syncInterval, UINT flags)
{
    //
    //... your code goes heere
    //   

    //execute original function to perform buffer swap
    return pOriginalD3D11PresentHook(pSwapChain, syncInterval, flags);
}

---

PLH::CapstoneDisassembler dis(PLH::Mode::x64);
    PLH::x64Detour detour((uint64_t)pSwapChainVtable[8], (uint64_t)&PresentHook, reinterpret_cast<uint64_t*>(&pOriginalD3D11PresentHook), dis);

Probably you have issues with objects lifetime. AFAIK, disassembler and detour objects should be alive during all the program execution time. Try to save it as global variables to test this.

---

Also, it is not so clear for me, do the crash occurs during .hook() execution or during first hooked function invocation?

[UCFoxi]

no thats the point, i added a messagebox to see if it get called but it dont even... its so weird and the original one gets called like this: return PLH::FnCast(pPresent, pOriginalD3D11PresentHook)(pSwapChain, syncInterval, flags);

[stevemk14ebr]

Please use a debugger, your guess is as good as anyone elses with the information provided. If this is a game it's very possible you are being caught by an anti-cheat system or a game integrity check. There is simply no way to know unless you pin point the cause of the crash and provide details. From the original assembly your provided it appears that polyhook has installed the hook correctly

For a 64bit game here is the correct typedef for your hook: https://github.com/stevemk14ebr/BF4-AtomBot/blob/e539c786578c95774c68fdd7dc9721a0a5cb9a39/BF4%20AtomBot/dllmain.cpp#L332

[UCFoxi]

ok i will try it pls its that stdcall xd