|
| 1 | +#include <windows.h> |
| 2 | +#include <strsafe.h> |
| 3 | +#include <dxgi.h> |
| 4 | + |
| 5 | +constexpr DWORD offsetD3DX10Check = 0xE7BDC5; |
| 6 | +constexpr DWORD offsetDenominatorFix = 0xE7CF51; |
| 7 | +constexpr DWORD offsetNumeratorSet = 0xE7CF6D; |
| 8 | +constexpr BYTE badDenominator[]{ 0xB8, 0x01, 0x00, 0x00, 0x00, 0x89, 0x44, 0x24, 0x6C }; |
| 9 | +constexpr BYTE badNumerator[] { 0xC7, 0x44, 0x24, 0x6C, 0x3C, 0x00, 0x00, 0x00 }; |
| 10 | + |
| 11 | +int WINAPI WinMain( _In_ HINSTANCE hInstance, _In_opt_ HINSTANCE hPrevInstance, _In_ LPSTR lpCmdLine, _In_ int nShowCmd ) |
| 12 | +{ |
| 13 | + const TCHAR extraArgs[] = TEXT(" -d3d10 -msaa"); |
| 14 | + TCHAR path[MAX_PATH + ARRAYSIZE( extraArgs ) + 1]; |
| 15 | + GetCurrentDirectory( MAX_PATH, path ); |
| 16 | + StringCbCat( path, sizeof( path ), TEXT( "\\UT3.exe" ) ); |
| 17 | + StringCbCat( path, sizeof( path ), extraArgs ); |
| 18 | + |
| 19 | + STARTUPINFOW si{}; |
| 20 | + si.cb = sizeof( si ); |
| 21 | + PROCESS_INFORMATION pi{}; |
| 22 | + if ( !CreateProcess( nullptr, path, nullptr, nullptr, false, CREATE_SUSPENDED, nullptr, nullptr, &si, &pi ) ) |
| 23 | + return -1; |
| 24 | + |
| 25 | + CONTEXT context{}; |
| 26 | + context.ContextFlags = CONTEXT_INTEGER; |
| 27 | + GetThreadContext( pi.hThread, &context ); |
| 28 | + |
| 29 | + PBYTE pBaseAddr = nullptr; |
| 30 | + ReadProcessMemory( pi.hProcess, reinterpret_cast<PVOID>( context.Ebx + 8 ), &pBaseAddr, sizeof( pBaseAddr ), nullptr ); |
| 31 | + |
| 32 | + // Patch incorrect check for D3DX10CheckVersion |
| 33 | + if ( BYTE inst = 0; ReadProcessMemory( pi.hProcess, pBaseAddr + offsetD3DX10Check, &inst, sizeof( inst ), nullptr ) && inst == 0x75 /*jnz*/ ) |
| 34 | + { |
| 35 | + DWORD old; |
| 36 | + VirtualProtectEx( pi.hProcess, pBaseAddr + offsetD3DX10Check, sizeof( inst ), PAGE_READWRITE, &old ); |
| 37 | + inst = 0x74; |
| 38 | + WriteProcessMemory( pi.hProcess, pBaseAddr + offsetD3DX10Check, &inst, sizeof( inst ), nullptr ); |
| 39 | + VirtualProtectEx( pi.hProcess, pBaseAddr + offsetD3DX10Check, sizeof( inst ), old, &old ); |
| 40 | + } |
| 41 | + |
| 42 | + // Patch hardcoded 60Hz refresh |
| 43 | + if ( IDXGIFactory1 *pDxgiFactory; SUCCEEDED( CreateDXGIFactory1( IID_PPV_ARGS( &pDxgiFactory ) ) ) ) |
| 44 | + { |
| 45 | + IDXGIAdapter* adapter; |
| 46 | + for ( UINT adapterIdx = 0; SUCCEEDED( pDxgiFactory->EnumAdapters( adapterIdx, &adapter ) ); ++adapterIdx ) |
| 47 | + { |
| 48 | + DXGI_ADAPTER_DESC adesc; |
| 49 | + adapter->GetDesc( &adesc ); |
| 50 | + if ( adesc.VendorId == 0x1414 && adesc.DeviceId == 0x8c ) // skip microsoft basic driver |
| 51 | + { |
| 52 | + adapter->Release(); |
| 53 | + continue; |
| 54 | + } |
| 55 | + |
| 56 | + IDXGIOutput *output = nullptr; |
| 57 | + for ( UINT outputIdx = 0; SUCCEEDED( adapter->EnumOutputs( outputIdx, &output ) ); outputIdx++ ) |
| 58 | + { |
| 59 | + // Get desktop's refresh rate |
| 60 | + DXGI_MODE_DESC search {}, monitor {}; |
| 61 | + search.Format = DXGI_FORMAT_B8G8R8A8_UNORM; |
| 62 | + DXGI_OUTPUT_DESC desc; |
| 63 | + output->GetDesc( &desc ); |
| 64 | + search.Width = desc.DesktopCoordinates.right - desc.DesktopCoordinates.left; |
| 65 | + search.Height = desc.DesktopCoordinates.bottom - desc.DesktopCoordinates.top; |
| 66 | + output->FindClosestMatchingMode( &search, &monitor, nullptr ); |
| 67 | + output->Release(); |
| 68 | + |
| 69 | + // There is not enough space to patch denominator inline, create thunk |
| 70 | + if ( BYTE denominator[ARRAYSIZE( badDenominator )]; ReadProcessMemory( pi.hProcess, pBaseAddr + offsetDenominatorFix, denominator, sizeof( denominator ), nullptr ) && !memcmp( denominator, badDenominator, sizeof( denominator ) ) ) |
| 71 | + { |
| 72 | + BYTE fix[]{ 0xB8, 0x01, 0x00, 0x00, 0x00, 0xC7, 0x44, 0x24, 0x70, 0x00, 0x00, 0x00, 0x00, 0xE9, 0x00, 0x00, 0x00, 0x00 }; |
| 73 | + *reinterpret_cast<UINT *>( fix + 9 ) = monitor.RefreshRate.Denominator; |
| 74 | + |
| 75 | + PVOID addr = VirtualAllocEx( pi.hProcess, nullptr, sizeof( fix ), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE ); |
| 76 | + *reinterpret_cast<DWORD *>( fix + 14 ) = reinterpret_cast<DWORD>( pBaseAddr + offsetDenominatorFix + sizeof( denominator ) ) - ( reinterpret_cast<DWORD>( addr ) + sizeof( fix ) ); |
| 77 | + WriteProcessMemory( pi.hProcess, addr, fix, sizeof( fix ), nullptr ); |
| 78 | + |
| 79 | + memset( denominator, 0x90, sizeof( denominator ) ); |
| 80 | + denominator[0] = 0xE9; |
| 81 | + *reinterpret_cast<DWORD *>( denominator + 1 ) = reinterpret_cast<DWORD>( addr ) - reinterpret_cast<DWORD>( pBaseAddr + offsetDenominatorFix + 5 ); |
| 82 | + DWORD old, old2; |
| 83 | + VirtualProtectEx( pi.hProcess, pBaseAddr + offsetDenominatorFix, sizeof( denominator ), PAGE_READWRITE, &old ); |
| 84 | + WriteProcessMemory( pi.hProcess, pBaseAddr + offsetDenominatorFix, denominator, sizeof( denominator ), nullptr ); |
| 85 | + VirtualProtectEx( pi.hProcess, pBaseAddr + offsetDenominatorFix, sizeof( denominator ), old, &old2 ); |
| 86 | + |
| 87 | + VirtualProtectEx( pi.hProcess, addr, sizeof( fix ), old, &old2 ); |
| 88 | + } |
| 89 | + |
| 90 | + BYTE numerator[ARRAYSIZE( badNumerator )]; |
| 91 | + ReadProcessMemory( pi.hProcess, pBaseAddr + offsetNumeratorSet, numerator, sizeof( numerator ), nullptr ); |
| 92 | + if ( !memcmp( numerator, badNumerator, sizeof( numerator ) ) ) |
| 93 | + { |
| 94 | + *reinterpret_cast<UINT *>( numerator + 4 ) = monitor.RefreshRate.Numerator; |
| 95 | + |
| 96 | + DWORD old; |
| 97 | + VirtualProtectEx( pi.hProcess, pBaseAddr + offsetNumeratorSet, sizeof( numerator ), PAGE_READWRITE, &old ); |
| 98 | + WriteProcessMemory( pi.hProcess, pBaseAddr + offsetNumeratorSet, numerator, sizeof( numerator ), nullptr ); |
| 99 | + VirtualProtectEx( pi.hProcess, pBaseAddr + offsetNumeratorSet, sizeof( numerator ), old, &old ); |
| 100 | + } |
| 101 | + |
| 102 | + break; // Grab info from first display only |
| 103 | + } |
| 104 | + |
| 105 | + adapter->Release(); |
| 106 | + break; // UT3 uses first adapter returned from DXGI |
| 107 | + } |
| 108 | + |
| 109 | + pDxgiFactory->Release(); |
| 110 | + } |
| 111 | + |
| 112 | + ResumeThread( pi.hThread ); |
| 113 | + CloseHandle( pi.hProcess ); |
| 114 | + CloseHandle( pi.hThread ); |
| 115 | + return 0; |
| 116 | +} |
0 commit comments