Undetected DIP Hook

#include <windows.h>
#include <d3d9.h>
#include <d3dx9.h>

#pragma comment(lib, "d3d9.lib")
#pragma comment(lib, "d3dx9.lib")

// NUMPAD1 => On/Off chams.
// NUMPAD2 => Change colors.

#define DIPEngine 0x004B490D
DWORD retDIPEngine = ( DIPEngine + 0x8 );

INT chams;
INT color;

#define Red D3DCOLOR_ARGB( 255, 255, 000, 000 )
#define Green D3DCOLOR_ARGB( 255, 000, 255, 000 )
#define Blue D3DCOLOR_ARGB( 255, 000, 000, 255 )
#define Black D3DCOLOR_ARGB( 255, 000, 000, 000 )

__declspec( naked ) HRESULT WINAPI DIPMidfunction( )
{
static LPDIRECT3DDEVICE9 pDevice;

__asm
{
MOV EDX, DWORD PTR DS:[EAX]
MOV EDX, DWORD PTR DS:[EDX + 0x148]
MOV DWORD PTR DS:[pDevice], EAX
PUSHAD
}

if( GetAsyncKeyState(VK_NUMPAD1)&1 )
chams = !chams;

if( GetAsyncKeyState(VK_NUMPAD2)&1 )
color++;

if( color > 4 )
color = 0;

if( chams )
{
pDevice->SetRenderState( D3DRS_ZENABLE, D3DZB_FALSE );
if( color == 1 ) pDevice->SetRenderState( D3DRS_AMBIENT, Red );
if( color == 2 ) pDevice->SetRenderState( D3DRS_AMBIENT, Green );
if( color == 3 ) pDevice->SetRenderState( D3DRS_AMBIENT, Blue );
if( color == 4 ) pDevice->SetRenderState( D3DRS_AMBIENT, Black );
}

__asm
{
POPAD
JMP retDIPEngine
}
}

void *DetourCreate( BYTE *src, const BYTE *dst, const int len )
{
BYTE *jmp =( BYTE * ) malloc( len + 5 );
DWORD dwBack;

VirtualProtect( src, len, PAGE_READWRITE, &dwBack );
memcpy( jmp, src, len );
jmp += len;
jmp[0] = 0xE9;
*( DWORD * )( jmp + 1 ) = ( DWORD )( src + len - jmp ) - 5;

src[0] = 0xE9;
*( DWORD * )( src + 1 ) = ( DWORD )( dst - src ) - 5;
for( int i = 5; i < len; i++ )
src[i] = 0x90;
VirtualProtect( src, len, dwBack, &dwBack );

return( jmp - len );
}

DWORD WINAPI StartRoutine( LPVOID )
{
while( TRUE )
{
if( memcmp( ( void * )DIPEngine, ( void * )( PBYTE )"\x8B\x10", 2 ) == 0 )
{
Sleep(200);
DetourCreate( ( PBYTE )DIPEngine, ( PBYTE )DIPMidfunction, 8 );
}
}

return 0;
}

BOOL WINAPI DllMain( HMODULE hDll, DWORD dwReason, LPVOID lpReserved )
{
if( dwReason == DLL_PROCESS_ATTACH )
{
DisableThreadLibraryCalls( hDll );
MessageBox( 0, "Hook DIP Engine", "Crossfire", 0 );
CreateThread( 0, 0, (LPTHREAD_START_ROUTINE)StartRoutine, 0, 0, 0 );
}

return TRUE;
}