.386
.model flat,stdcall
option casemap:none

WinMain proto :DWORD,:DWORD,:DWORD,:DWORD
GetHandleProc proto
SpyCheckProc proto :DWORD
AboutProc proto :DWORD,:DWORD,:DWORD,:DWORD

include \masm32\include\windows.inc
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc
includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib

;Define macro
szText MACRO Name, Text:VARARG 
        LOCAL lbl 
          jmp lbl 
            Name db Text,0 
          lbl: 
        ENDM

.data

ClassName db "OneClass",0
MenuName db "MyMenu",0
DlgName db "MyDialog",0
AppName db "Diablo II Auto Hits",0
TestString2 db "You clicked on the Undo Menu",0
AboutDlgName db "AboutBox",0		;About dialog
InstDlgName db "InstBox",0		;Instructions dialog
InfoDlgName db "InfoBox",0		;Hack info dialog


;String to search
GameName db "Diablo II",0

;ERRORS 
err_cap db "ERROR",0

err_noText db "You must specify the number of hit  ",0
err_zero db "Zero is not a valid number!	",0
err_mustRun db "Diablo II must be running!	",0
err_writing db "DLLs are not totally loaded in memory.	",13,10
	    db "	Join a game first",0	    
err_writingOld db "Cannot write in memory	",0


;DONE
doneText db "Diablo II has been successfully patched!",0
oldText db "The hack has been unloaded",0

infoText db "This hack works on Battle.net Realms, open games and TCP/IP games whether you're the host or not.",13,10
	 db 13,10
	 db "What this program does :",13,10
	 db "- Attack monsters/players on your screen by clicking on them without moving (Client side).",13,10
	 db "- Send multiple attack packets at the same time per click.",13,10
	 db "- Last Hit feature : Pressing the Space Bar will attack the last monster/player that you clicked on.",13,10
	 db 13,10
	 db "A complete and more detailed description of this hack can be found in the readme.txt along with this package.",13,10
	 db 13,10,13,10
	 db "The original copy of this program can always be found at http://onesided.cjb.net",0

;Icon
hIcon	  dd 0

;------------------------------------------------------------
;Datas to be written

buffer db 06h,01h,00h,00h,00h,01h,00h,00h,00h

monstClickData db 0e8h,021h,73h,1bh,00h,90h,90h

playerClickData db 0e8h,9eh,73h,1bh,00h,90h,90h,90h,90h,90h

playerClickSub db 0c6h,05h,4bh,0f8h,0cfh,6fh,00h,0e8h,0a4h,0ffh,0ffh,0ffh,0c3h

hitRoutineData db 0c6h,05h,4bh,0f8h,0cfh,6fh,01h,0e8h,04h,00h,00h,00h,8bh,46h,1ch,0c3h
	       db 89h,1dh,4fh,0f8h,0cfh,6fh,60h,66h,8bh,35h,5ah,0f8h,0cfh,6fh,0b9h,4ah
	       db 0f8h,0cfh,6fh,8bh,15h,84h,0b0h,0c0h,6fh,6ah,00h,6ah,09h,51h,52h,0ffh
	       db 15h,84h,71h,0c0h,6fh,66h,4eh,66h,85h,0f6h,75h,0e2h,61h,0c3h
	     
spaceAddData db 0e8h,0bh,24h,23h,00h,0c3h

;------------------------------------------------------------

;Original Datas

monstClickOld db 85h,0c0h,74h,25h,8bh,46h,1ch

playerClickOld db 53h,33h,0d2h,8bh,0ceh,0e8h,0efh,02h,00h,00h
	       
spaceAddOld db 0e9h,0ebh,0b6h,0fdh,0ffh,90h


.data?

hInstance HINSTANCE ?
retDlg dd ?
getInt db ?
nbLoop dw ?
processID dd ?
processHandle dd ?


.const
IDC_APPLY      equ 3000
IDC_UNDO        equ 3001
IDC_TEXT	equ 3002
IDC_GETNB	equ 3003
IDM_APPLY     equ 32000
IDM_UNDO      equ 32001
IDM_EXIT        equ 32002
IDM_ABOUT	equ 32003
IDM_INST	equ 32004
IDM_INFO	equ 32005

INFO_TEXT	equ 5000
IDC_ABOUTOK	equ 4000

;Addresses memory to be patched
SPEEDADD equ 6fcff85ah
BUFFADD equ 6fcff84ah
MONSTCLICK equ 6fb484e4h
PLAYERCLICK equ 6fb484c7h
PLAYERCLICKSUB equ 6fcff86ah
HITROUTINE equ 6fcff80ah
SPACEADD equ 6facd410h


.code
start:
	invoke GetModuleHandle, NULL
	mov    hInstance,eax
	
	invoke WinMain, hInstance,NULL,NULL,SW_SHOWDEFAULT
	invoke ExitProcess,eax
	
	
WinMain proc hInst:HINSTANCE,hPrevInst:HINSTANCE,CmdLine:LPSTR,CmdShow:DWORD
	
	LOCAL wc:WNDCLASSEX
	LOCAL msg:MSG
	LOCAL hDlg:HWND
	
	invoke LoadIcon,hInst,500    ; icon ID
      	mov hIcon, eax
	
	mov   wc.cbSize,SIZEOF WNDCLASSEX
	mov   wc.style, CS_HREDRAW or CS_VREDRAW
	mov   wc.lpfnWndProc, OFFSET WndProc
	mov   wc.cbClsExtra,NULL
	mov   wc.cbWndExtra,DLGWINDOWEXTRA
	push  hInst
	pop   wc.hInstance
	mov   wc.hbrBackground,COLOR_BTNFACE+1
	mov   wc.lpszMenuName,OFFSET MenuName
	mov   wc.lpszClassName,OFFSET ClassName
	
	push hIcon		; Put Icon on the Exe
	pop   wc.hIcon
	push hIcon
	pop   wc.hIconSm
	
	invoke LoadCursor,NULL,IDC_ARROW
	mov   wc.hCursor,eax
	invoke RegisterClassEx, addr wc
	
	invoke CreateDialogParam,hInstance,ADDR DlgName,NULL,NULL,NULL
	mov   hDlg,eax
		
	INVOKE ShowWindow, hDlg,SW_SHOWNORMAL
	INVOKE UpdateWindow, hDlg
	
	invoke GetDlgItem,hDlg,IDC_APPLY
	invoke SetFocus,eax
			
	.WHILE TRUE
                INVOKE GetMessage, ADDR msg,NULL,0,0
                .BREAK .IF (!eax)
                invoke IsDialogMessage, hDlg, ADDR msg
                .if eax==FALSE
                        INVOKE TranslateMessage, ADDR msg
                        INVOKE DispatchMessage, ADDR msg
                .endif
	.ENDW
	mov     eax,msg.wParam
	ret
WinMain endp

WndProc proc hWnd:HWND, uMsg:UINT, wParam:WPARAM, lParam:LPARAM
						
	.IF uMsg==WM_DESTROY
		invoke PostQuitMessage,NULL
	.ELSEIF uMsg==WM_COMMAND
		mov eax,wParam
		.IF lParam==0
			
			;***********************************************
			.IF ax==IDM_APPLY
			
				invoke GetDlgItemInt,hWnd,IDC_GETNB,addr getInt,FALSE
				.IF getInt==FALSE
					invoke MessageBox,hWnd,addr err_noText,addr err_cap,MB_OK
				
				.ELSE			
										
					.IF eax==NULL 	;If the user entered 0 hit
						invoke MessageBox,hWnd,addr err_zero,addr err_cap,MB_ICONERROR
						
					.ELSE					
								
						mov nbLoop,ax	;Get the number entered
										
						invoke SpyCheckProc,hWnd
					
						.IF eax==NULL		;Spy doesn't exist
					
							call GetHandleProc	;Get the handle of DII
							
							.IF eax!=NULL		;Diablo is running
						
								;Write memory
												
								invoke WriteProcessMemory,processHandle,SPEEDADD,addr nbLoop,SIZEOF nbLoop,NULL
								test eax,eax
								jz Error_Writing
			
								invoke WriteProcessMemory,processHandle,BUFFADD,addr buffer,SIZEOF buffer,NULL
								test eax,eax
								jz Error_Writing
								
								invoke WriteProcessMemory,processHandle,MONSTCLICK,addr monstClickData,SIZEOF monstClickData,NULL
								test eax,eax
								jz Error_Writing
							
								invoke WriteProcessMemory,processHandle,PLAYERCLICK,addr playerClickData,SIZEOF playerClickData,NULL
								test eax,eax
								jz Error_Writing
								
								invoke WriteProcessMemory,processHandle,PLAYERCLICKSUB, addr playerClickSub,SIZEOF playerClickSub,NULL
								test eax,eax
								jz Error_Writing
							
								invoke WriteProcessMemory,processHandle,HITROUTINE,addr hitRoutineData,62,NULL
								test eax,eax
								jz Error_Writing
								
								invoke WriteProcessMemory,processHandle,SPACEADD,addr spaceAddData,SIZEOF spaceAddData,NULL
								test eax,eax
								jz Error_Writing
										
								;Patch successful							
								invoke MessageBox,hWnd,addr doneText,addr AppName,MB_OK
								jmp Done
							
							
								Error_Writing:
									invoke MessageBox,hWnd,addr err_writing,addr err_cap,MB_ICONERROR
								
								Done:
							
									invoke CloseHandle,processHandle ;Close the opened process
							
							.ENDIF
						.ENDIF						
					.ENDIF
				.ENDIF			
			;***********************************************	
				
			.ELSEIF ax==IDM_UNDO
				
				invoke SpyCheckProc,hWnd
				
				.IF eax==NULL		;Spy doesn't exist
				
					invoke GetHandleProc	;Get the handle of DII
			
					.IF eax!=NULL		;Diablo is running
				
						invoke WriteProcessMemory,processHandle,MONSTCLICK,addr monstClickOld,SIZEOF monstClickOld,NULL
						test eax,eax
						jz Error_Patching
								
						invoke WriteProcessMemory,processHandle,PLAYERCLICK,addr playerClickOld,SIZEOF playerClickOld,NULL
						test eax,eax
						jz Error_Patching
				
				
						invoke WriteProcessMemory,processHandle,SPACEADD,addr spaceAddOld,SIZEOF spaceAddOld,NULL
						test eax,eax
						jz Error_Patching
				
				
					;Patch successful
					invoke MessageBox,hWnd,addr oldText,addr AppName,MB_OK
					jmp Done2
					
					Error_Patching:
					
						invoke MessageBox,hWnd,addr err_writingOld,addr err_cap,MB_ICONERROR
										
					Done2:
					
						invoke CloseHandle,processHandle ;Close the opened process
						
					.ENDIF
					
				.ENDIF	
				
					
			.ELSEIF ax==IDM_ABOUT
			
				invoke DialogBoxParam,hInstance,addr AboutDlgName,hWnd,addr AboutProc,NULL
				mov retDlg,eax
							
							
			.ELSEIF ax==IDM_INST
			
				invoke DialogBoxParam,hInstance,addr InstDlgName,hWnd,addr AboutProc,NULL
				mov retDlg,eax			
			
			
			.ELSEIF ax==IDM_INFO
			
				invoke DialogBoxParam,hInstance,addr InfoDlgName,hWnd,addr AboutProc,NULL
				mov retDlg,eax	
			
			
			.ELSE
				invoke DestroyWindow,hWnd
				
			.ENDIF
		.ELSE
			mov edx,wParam
			shr edx,16
			.IF dx==BN_CLICKED
				.IF ax==IDC_APPLY
					invoke SendMessage,hWnd,WM_COMMAND,IDM_APPLY,0
                        	.ELSEIF ax==IDC_UNDO
					invoke SendMessage,hWnd,WM_COMMAND,IDM_UNDO,0
				.ENDIF
			.ENDIF
		.ENDIF
	.ELSE
		invoke DefWindowProc,hWnd,uMsg,wParam,lParam
		ret
	.ENDIF
	xor    eax,eax
	ret
WndProc endp


GetHandleProc proc 

	invoke FindWindow,NULL,addr GameName
	.IF eax==NULL
		invoke MessageBox,NULL,addr err_mustRun,addr err_cap,MB_ICONEXCLAMATION
		xor eax,eax
		ret
	.ENDIF
	
	invoke GetWindowThreadProcessId,eax,addr processID
	invoke OpenProcess,PROCESS_ALL_ACCESS,NULL,processID
	
	mov processHandle,eax
	ret
	
GetHandleProc endp
		
		
SpyCheckProc proc handle:HWND

	szText SpyName,"TRAINER SPY"
	invoke FindWindow,NULL,addr SpyName

	.IF eax!=NULL	;Spy exists

		szText err_trainerSpy,"Close trainer spy...	"	;Hide string
		invoke MessageBox,handle,addr err_trainerSpy,addr err_cap,MB_ICONERROR
		push 1
		pop eax
		
	.ENDIF	
		
	ret

SpyCheckProc endp
		
		
AboutProc proc hWnd:HWND, uMsg:UINT, wParam:WPARAM, lParam:LPARAM

	.IF uMsg==WM_INITDIALOG
		invoke GetDlgItem, hWnd,IDC_ABOUTOK
		invoke SetFocus,eax
		
		invoke SetDlgItemText,hWnd,INFO_TEXT,addr infoText
		
	.ELSEIF uMsg==WM_CLOSE
		invoke EndDialog,hWnd,NULL	

	.ELSEIF uMsg==WM_COMMAND	
		mov eax,wParam
		mov edx,eax
		shr edx,16
		.IF dx==BN_CLICKED
			.IF eax==IDC_ABOUTOK
				invoke EndDialog,hWnd,NULL
				
			.ENDIF
			
		.ENDIF
		
	.ELSE
		mov eax,FALSE
		ret
		
	.ENDIF
	
	mov eax,TRUE
	ret
	
AboutProc endp

end start

				  Diablo II Auto Hits

-------------------------------------
CHANGES :

Version 1.1 08/22/01
1. Works with DII v1.09
2. Fixed the zero hit bug

-------------------------------------
				
				  
This hack works on Battle.net Realms, open games and TCP/IP games whether you're the host
or not. What this program does :

- Attack monsters/players on your screen by clicking on them without moving (Client side).
- Send multiple attack packets at the same time per click.
- Last Hit feature : Pressing the Space Bar will attack the last monster/player that you clicked
on.


However, even if it doesn't appear on the client screen, when you click on a target you will
actually go near of your enemy, or at the appropriate range of you weapon, to be able to hit
him. Which means, monsters/players are able to hit you even if they appear far from you. 

The configurable ammount of hit is actually the number of attack packets sent to the server when
you click on a target. Since all these packets are sent at the same time, most of them will be
ignored by the server. So it means the higher you set the number, the most will be actually 
valids and interpreted correctly. Setting it to 500 will approximately be 3 attacks in a row.
I've set the default ammount to 300. Note that setting it higher than this might freeze for a sec
people with low connection speed. The maximum is set to 999, cause if you send this ammount at
the same time you will most likely get booted from the game.

Pressing the Space Bar on your keyboard will automaticly attack the last monster or player you
have clicked on during that game. Can be useful while dueling or for Bosses. Also, it gives
you the chance to do other things while attacking, like taking a potion or running in circle :)
It's the same as if you were clicking on the target, so it will also send the number of attack
packets that you specified.

You can apply or unload the hack at anytime, but you must at least have joined one game since
you ran Diablo II to load all DLLs in memory.


This hack is not awesome, but I decided to release it 'cause some people might like it.


				Greetings to everyone I know and
			 special thanks to Red2run and ��V�G�^V^�W~��� 
			   for being my beta testers and to have spent
		    times with me while I was working on my codes and trying
				        some new shits :)


Have fun.

* -Arsenic-  a.k.a  Artemis`Entreri
My codes : http://onesided.cjb.net