Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
OBS-graphics-hook32-Hook — Demonstrates hooking OBS graphics-hook32.dll's D3D9 Present pointer to achieve stream-proof rendering that evades anti-cheat game capture detection. | Kitploit
Tools/GitHubGitHub/gmh5225/obs-graphics-hook32-hook
Web Proxies & InterceptionIDS/IPS EvasionReverse EngineeringBinary AnalysisLearning & EducationRed TeamingAnti-Bot
GitHubgmh5225/obs-graphics-hook32-hook

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →

OBS-graphics-hook32-Hook

Demonstrates hooking OBS graphics-hook32.dll's D3D9 Present pointer to achieve stream-proof rendering that evades anti-cheat game capture detection.

View Repository
214 years agoNot yet reviewed
Share

OBS-graphics-hook32-Hook

Not mine. Only for saving. https://www.unknowncheats.me/forum/anti-cheat-bypass/501609-obs-graphics-hook32-hook.html

I've studied many types of hooking before, and this kind of stuff caught my attention because it could be used to produce stream-proof rendering.

So I'd like to share it with those beginners out there. image

"graphics-hook32.dll + 32DC8" is our target address, which should look like this in your IDA or https://github.com/obsproject/obs-st...pture.cpp#L651

image

After that, all you have to do is replace the pointer ( the old way ). Since mov eax, Hook_Present_Addr Hook_Present_Addr = &Present_hook ??? PROFIT Ready to P2C KEKEKEKEKEKW

void MainThread()
{
	while (!obsBase) // check if graphics-hook32.dll is not loaded
	{
		obsBase = (DWORD)GetModuleHandleA(XorStr("graphics-hook32.dll"));
		if (!obsBase)
			Sleep(200);
		else
			isOBSFound = true; 
	}
	if (isOBSFound)
	{
		renderOBSPresent = obsBase + 0x32DC8;
		while (!*reinterpret_cast<uintptr_t*>(renderOBSPresent))
		{
			Sleep(200);
		}
		OrigPresent = SwapPointer<Present_t>((uintptr_t)renderOBSPresent, (uintptr_t)&Hooked_Present);
	}
}

The function pointer we're replacing is the "RealPresent" shown on ida not the present_begin(RealPresent function is a .data ptr). You could also hook the present_begin and achieve the same result. This is also applicable for the x64 version of obs.

Note: this only works for game capture and d3d9 game

Download Tool