Question [Crash] Combat Arms D3D9 Hook — 1-Minute Disconnect & Memory Fixes

[byte_corvus]

Still messing with old bases for Combat Arms? If you're getting kicked exactly 60 seconds after injection, you're likely tripping a server-side heartbeat or hitting an integrity check on the LTClient memory segments.

The Technical Breakdown

The source provided is a classic D3D9 internal using a VTable detour on the Present function (Index 17). While the logic is functional for a basic paste, there are several red flags that lead to instability or instant kicks.

1. Rendering Loop Abuse: You are writing to memory addresses like JumpVel and FRunVel every single frame inside the Present loop. This is not only inefficient but creates a massive footprint for any anti-cheat monitoring those addresses for changes.
2. Hardcoded Offsets: The addresses for DeviceGame (0x8428B0) and LTClient functions are static. If the game build has updated even slightly, these will point to garbage, causing the DC or a straight crash to desktop.
3. Console Execution: The ComandoEvil function calls LTClientEXE to push console commands like "+SkelModelStencil". Many servers now check for modified CVars or restricted console commands, which can trigger a timed disconnect.

The Source Meat

#include <windows.h>

#include <d3dx9.h>

#pragma comment(lib, "d3dx9.lib")

 

 

bool iChams, iJump, iSpeed;

 

#define LTClientEXE            0x4909F0

#define JumpVel                0x384870D4

#define FRunVel                0x38487068

#define BRunVel                0x3848708C

#define SRunVel                0x384870B0

#define GameStatus            0x384274BC

 

VOID pMemoria(LPVOID andress, LPVOID ByteMemcpy, INT Len)

{

    DWORD dwBack;

    VirtualProtect((LPVOID)andress, Len, 0x40, &dwBack);

    memcpy((LPVOID)andress, ByteMemcpy, Len);

    VirtualProtect((LPVOID)andress, Len, dwBack, &dwBack);

}

 

VOID VerifyClick(bool&val, int vkKey)

{

    if (GetAsyncKeyState(vkKey) & 1)

        val = !val;

}

VOID Console(CONST CHAR* CMD)

{

    _asm

    {

        PUSH CMD

        MOV EAX, LTClientEXE

        CALL EAX

        ADD ESP, 0x4

    }

}

 

void FeatureCode()

{

    if (*(BYTE*)GameStatus == 1)

    {

        if (iChams)

        {

            Console("+SkelModelStencil 1");

        }

        else

        {

            Console("+SkelModelStencil 0");

        }

        if (iSpeed)

        {

            *(FLOAT*)FRunVel = 285.0f * 2;

            *(FLOAT*)BRunVel = 285.0f * 2;

            *(FLOAT*)SRunVel = 285.0f * 2;

        }

        else

        {

            *(FLOAT*)FRunVel = 285.0f;

            *(FLOAT*)BRunVel = 285.0f;

            *(FLOAT*)SRunVel = 285.0f;

        }

        if (iJump)

        {

            *(FLOAT*)JumpVel = 330.0f * 2;

        }

        else

        {

            *(FLOAT*)JumpVel = 330.0f;

        }

    }

}

#include "Func.h"

 

BOOL CheatActivationStuff()

{

    while (GetModuleHandle("cshell.dll") == NULL) {}

 

    while (true)

    {

 

        VerifyClick(iChams, VK_NUMPAD1);

        VerifyClick(iJump, VK_NUMPAD2);

        VerifyClick(iSpeed, VK_NUMPAD3);

 

        FeatureCode();

    }

    return true;

}

BOOL __stdcall DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)

{

    static HANDLE Thread;

 

    switch (ul_reason_for_call)

    {

    case DLL_PROCESS_ATTACH:

        DisableThreadLibraryCalls(hModule);

        Thread = CreateThread(0,0, (LPTHREAD_START_ROUTINE)CheatActivationStuff, NULL, NULL, NULL);

        break;

 

    case DLL_PROCESS_DETACH:

        if (Thread != NULL)

        {

            TerminateThread(Thread, 0);

        }

        break;

    }

    return true;

}

Preventive Troubleshooting

To fix the 1-minute DC, first, check if CShell.dll and ClientFX.fxd are actually valid—if the game updated, your GameStatus check might be failing, leading you to write to null or incorrect pointers.

Another tip: Stop using VirtualProtect without checking the current protection state properly. Also, try moving your memory modifications into a separate thread that only updates when a key is pressed, rather than slamming the CPU in the render loop. If the server is doing server-side speed checks, FRunVel multipliers are an instant flag if they exceed the threshhold for too long.

drop your crash logs below