[Question] Hook EndScene

Thanks for the info, I just want to hook EndScene so I can use PTC methods, Im not interested about including Dx9 library headers with my code and using it so all arguments coming into my hooked EndScene callback will just get directed to original EndScene, but I will call PTC method and hopfully it should work because im in the context of d3d9 function.

I will try the theory d3d9Base + Offset to hook that address and see what happends..

Can anyone confirm the EndScene address for me ????

What you are trying to accomplish here is called Midfunction Hook there are a lot of tutorials about it just google it

btw: i hate mid function hooks cause they are pain in the ass! works on one OS and doesn't work on another :/

What is this "regular way"? |:

Yeah I understand that like I said "d3d9.dll base" I was looking in olly again and found the table you guys call "Vtable" I really have no idea why alot of people go through all the trouble using a pointer of a pointer of pointer ect... I thought d3d9.dll is the same on any system? and therefore will have the same offset from base address, Even if there was a different d3d9.dll for lets say windows XP you could get the offset from base address in the d3d9.dll for XP and then in your code just check OS version, Anyway I doubt they would release different d3d9.dll for each system...

He's saying that mid-function hooking causes trouble... but really, to accomplish what you're wanting (and I'm pretty sure this is how you're doing it in your head)

You could do:

he is a delphi coder
and he is talking about the hook not the function it self

@OP and FP (first post)

Yes, you're correct.

He doesn't want to do that.

The "Vtable" is the virtual function table in it.

You can just create a DX device with the same parameters gives you the same pointer to the current DX Device as well as all its functions.

You can also do a signature scan for the device pointer, which will be the same on all applications using the same DirectX version as the one you're scanning (scan for 8, 9, 10 and 11 if you want them all).

Actually Apoc91 is correct. This is exactly What I had in mind to get the PTC method working.. Difference is I will be using inline assembly in hooked EndScene Callback, As much as I would like to create DX device I wont be doing it as I dont want to even deal with DX9(not in Delphi anyway) thus I will not have any of the DX9 headers and units. I did'nt even want to hook from the start but after some info supplyed by freedompeace and other members I now relize you can'nt call the PTC method from your own thread, it must be called from a context of d3d9 thus the reason why I want to hook the simplest dx function(EndScene) as it only requires a pointer for arguments and will be passed straight to the original EndScene...


My idea...

Hook(d3d9Base + EndSceneOffset, @NewEndScene, @OriginalEndScene)

Then in my NewEndScene Callback...
I have not tested this but now I think you get the what my mind set is to get PTC method working...

Once I get PTC working I will go further and start using the DX9 Types and classes(there is a delphi implementation I seen on the net for the DX9). But for now I just want to be able to use PushToConsole.


//Edit

I got rapped up in what I want to do that I forgot to tell you guys why I want to find out about the Vtables...

I dont understand why people are using a sig scanner on d3d9.dll to get the pointer to the vTable, Because in my head the Vtable address should always be the same offset from the d3d9 base address, As should the EndScene scene address, The only reason I can think why it would be different is because a different version of d3d9.dll for different OS's... And freedompeace even said some people get the pointer to the pointer of the pointer to the Vtable from Engine.exe, this in my mind makes no sense, why go through all that trouble? you should be only calculating from the base address of d3d9.dll when its loaded... So my question is what is the reason behind this because I lot of source I seen do this, So im guessing there must be a reason.... even if you wanted multiple d3d9 functions wouldn't it be easyer just to do something like d3d9base + OffsetToVTable which would land you on the first Vtable entry?

This Vtable is just DB pointers to function addresses, so im not sure why this is even used unless it changes which would make the d3d9.dll polymorphic code(which it is not)

Apparently calling from endscene works as opposed to calling from your thread.

It has something to do with it (well, any D3D function you hook does, really) when you consider that you can't call RunConsoleCommand from your thread. (I'd say you could hack it up and do it, but imo it's a lot less effort to just hook EndScene/Present or something and handle it there.)


You should be able to use Base + Offset, since as you said it's pretty much the same thing. I think what happened was one person showed you could do it one way (whether it's via Engine.exe or just creating your own device), and everyone leeched it from there.