That hook was posted by @-fLuX ... I justed updated Code: #define VC_EXTRALEAN #define WIN32_LEAN_AND_MEAN #define _CRT_SECURE_NO_WARNINGS #include <d3d9.h> #include <d3dx9.h> #pragma comment( lib, "d3d9.lib" ) #pragma comment( lib, "d3dx9.lib" ) #include <Windows.h> #include <detours.h> #pragma comment( lib, "detours.lib" ) #include "Xor.h" #define ADDR_DEVICE 0x1177848//ADDR_CFBR typedef unsigned int uint32; typedef uint32 LTRESULT; DWORD ILTClient, FindDevice; typedef LTRESULT(__cdecl *_End3D)(uint32 flags); _End3D oEnd3D; //luizimloko project LPD3DXFONT D3DDirectxFont; BOOL D3DFontBoolean; VOID StartFont(LPDIRECT3DDEVICE9 pDevice) { if (D3DDirectxFont) { D3DDirectxFont->Release(); D3DDirectxFont = NULL; D3DFontBoolean = FALSE; } if (!D3DFontBoolean) { D3DXCreateFontA(pDevice, 12, 0, 350, 1, 0, 1, 0, 4, 0 | (0 << 4), "Arial", &D3DDirectxFont); D3DFontBoolean = TRUE; } } VOID DrawText(INT x, INT y, DWORD Color, CHAR *Text) { RECT Rect; SetRect(&Rect, x, y, x, y); D3DDirectxFont->DrawTextA(NULL, Text, -1, &Rect, DT_LEFT | DT_NOCLIP, Color); } LTRESULT __cdecl MyEnd3D(uint32 flags) { static LPDIRECT3DDEVICE9 pDevice; pDevice = **(LPDIRECT3DDEVICE9 **)ADDR_DEVICE; if (pDevice) { StartFont(pDevice); DrawText(50, 50, 0xFFFF0000, "End3D Hook"); } return oEnd3D(flags); } DWORD FindPattern(DWORD dwStart, DWORD dwLen, BYTE *pszPatt, CHAR pszMask[]) { //Credits: Gellin UINT i = NULL; INT iLen = strlen(pszMask) - 1; for (DWORD dwRet = dwStart; dwRet < dwStart + dwLen; dwRet++) { if (*(BYTE *)dwRet == pszPatt || pszMask == '?') { if (pszMask[i + 1] == '\0') return(dwRet - iLen); i++; } else i = NULL; } return NULL; } void End3DHook() { while (!(GetModuleHandleA(eCShell) != 0 && GetModuleHandleA(eClient) != 0)) Sleep(250); DWORD CShell = (DWORD)GetModuleHandleA(eCShell); ILTClient = FindPattern(CShell, 0xFFFFFF, (PBYTE)"\x8B\x0D\x00\x00\x00\x00\x8B\x11\x8B\x82\x00\x00\x00\x00", "xx????xxxx????"); ILTClient = *(DWORD*)(ILTClient + 0x2); DWORD End3D = *(DWORD*)(*(DWORD*)ILTClient + 0xD4);//0xD4 End3D oEnd3D = (_End3D)DetourFunction((PBYTE)End3D, (PBYTE)MyEnd3D); } BOOL WINAPI DllMain(HINSTANCE hModule, DWORD lpflReason, LPVOID lpflReserved) { if (lpflReason == DLL_PROCESS_ATTACH) { DisableThreadLibraryCalls(hModule); CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)End3DHook, hModule, NULL, NULL); } return TRUE; }