Hooking DirectX EndScene from an injected DLL

by

You install a system wide hook. (SetWindowsHookEx) With this done, you get to be loaded into every process.

Now when the hook is called, you look for a loaded d3d9.dll.

If one is loaded, you create a temporary D3D9 object, and walk the vtable to get the address of the EndScene method.

Then you can patch the EndScene call, with your own method. (Replace the first instruction in EndScene by a call to your method.

When you are done, you have to patch the call back, to call the original EndScene method. And then reinstall your patch.

This is the way FRAPS does it. (Link)

You can find a function address from the vtable of an interface.

So you can do the following (Pseudo-Code):

IDirect3DDevice9* pTempDev = ...;
const int EndSceneIndex = 26 (?);

typedef HRESULT (IDirect3DDevice9::* EndSceneFunc)( void );

BYTE* pVtable = reinterpret_cast<void*>( pTempDev );
EndSceneFunc = pVtable + sizeof(void*) * EndSceneIndex;

EndSceneFunc does now contain a pointer to the function itself. We can now either patch all call-sites or we can patch the function itself.

Beware that this all depends on the knowledge of the implementation of COM-Interfaces in Windows. But this works on all windows versions (either 32 or 64, not both at the same time).

More Related Contents:

  1. how to control one program from other
  2. How to achieve smooth tangent space normals?
  3. Capture screen using DirectX
  4. Why must SetWindowsHookEx be used with a windows message queue
  5. How can I hook Windows functions in C/C++?
  6. SetWindowsHookEx for WH_MOUSE
  7. SendInput() not equal to pressing key manually on keyboard in C++?
  8. Forcing NVIDIA GPU programmatically in Optimus laptops
  9. Hook/Overlay a DirectX game?
  10. DirectX/C++ 3D Engine programming: Learn now, or wait for DirectX 12? [closed]
  11. Difference between list<Observer*>* and list<Observer*> in C++ [closed]
  12. What happens when I print an uninitialized variable in C++?
  13. Sin and Cos give unexpected results for well-known angles
  14. Win32 programming hiding console window
  15. GNU GCC (g++): Why does it generate multiple dtors?
  16. Error: invalid operands of types ‘const char [35]’ and ‘const char [2]’ to binary ‘operator+’
  17. Problems with Singleton Pattern
  18. Is it possible to std::move objects out of functions? (C++11)
  19. Keyboard Input & the Win32 message loop
  20. Automatically adding Enter/Exit Function Logs to a Project
  21. Read process memory of a process does not return everything
  22. Get function names from call stack
  23. C++ on x86-64: when are structs/classes passed and returned in registers?
  24. Changing Function Access Mode in Derived Class
  25. Is it OK to use C-style cast for built-in types?
  26. comma operator in if condition
  27. QDialog exec() and getting result value
  28. What is the point of clog?
  29. What does *& mean in a function parameter
  30. Reasonably portable way to get top 64-bits from 64×64 bit multiply? [duplicate]

Leave a Comment