DirectX11 Hook and Render

**-Ryuk-** · 09-21-2016

Hi Everyone,

I'm busy converting one of my projects which currently uses DX9 to draw; which is fine but it forces me to use DX9 in wow and since I have nice hardware I would much prefer to use it to its potential and use DX11.

The problem is I have never used DX11 and I can't find much good information about it; at least none about rendering on someone else's device.

My hook is like this:

Code:

        private int Callback(IntPtr swapChainPtr, int syncInterval, PresentFlags flags)
        {
            this.Pointer = swapChainPtr;
            RaiseEvent(); //This just calls my onFrame functions
            return (int)_presentHook.CallOriginal(swapChainPtr, syncInterval, flags);
        }

This works fine I do get a valid swapChainPtr!

However, I'm stuck on how to get the device for this swapchain. I should point out I'm using SlimDx(purely because my dx9 code already works with it and since I have a friend who uses this project as well I need to keep dx9 support as well)

I have looked at the SlimDx documentation but it's not great and I can't find how to get a SlimDX.Direct3D11.Device from wows swapchain.

I have tried the following:

Code:

//This works but is not the device I am looking for
     SwapChain swapChain = SwapChain.FromPointer(swapChainPtr);
     SlimDX.DXGI.Device ddd = swapChain.Device;

Code:

//This gives an error about being unable to create the device from the user provided pointer
_DeviceDX11 = SlimDX.Direct3D11.Device.FromPointer(swapChain);

For DirectX9 it was very easy:

Code:

_DeviceDX9 = SlimDX.Direct3D9.Device.FromPointer(Hook.DevicePointer);

Can anyone help?

Thanks

**lolp1** · 09-22-2016

I do not use SlimDX, but you want something like this. Just send me a PM if you want the full set of classes for my generic hook x32/64 d3d9/11 hook that checks which one to detour at runtime.

Code:

        [DllImport("d3d11.dll")]
        public static extern unsafe int D3D11CreateDeviceAndSwapChain(void* pAdapter, int driverType, void* Software,
            int flags, void* pFeatureLevels,
            int FeatureLevels, int SDKVersion,
            void* pSwapChainDesc, void* ppSwapChain,
            void* ppDevice, void* pFeatureLevel,
            void* ppImmediateContext);

Then you grab the device pointer

Code:

      protected override void InitD3D(out IntPtr d3DDevicePtr)
        {
            LoadDxgiDll();
            var scd = new SwapChainDescription
            {
                BufferCount = 1,
                ModeDescription = new ModeDescription {Format = DXGI_FORMAT_R8G8B8A8_UNORM},
                Usage = DXGI_USAGE_RENDER_TARGET_OUTPUT,
                OutputHandle = Form.Handle,
                SampleDescription = new SampleDescription {Count = 1},
                IsWindowed = true
            };

            unsafe
            {
                var pSwapChain = IntPtr.Zero;
                var pDevice = IntPtr.Zero;
                var pImmediateContext = IntPtr.Zero;

                var ret = D3D11CreateDeviceAndSwapChain((void*) IntPtr.Zero, D3D_DRIVER_TYPE_HARDWARE,
                    (void*) IntPtr.Zero, 0, (void*) IntPtr.Zero, 0, D3D11_SDK_VERSION, &scd, &pSwapChain, &pDevice,
                    (void*) IntPtr.Zero, &pImmediateContext);

                _swapChain = pSwapChain;
                _device = pDevice;
                d3DDevicePtr = pImmediateContext;

                if (ret >= 0)
                {
                    var vTableFuncAddress = GetVTableFuncAddress(_swapChain, VTableIndexes.DXGISwapChainRelease);
                    _swapchainRelease = Marshal.GetDelegateForFunctionPointer<VTableFuncDelegate>(vTableFuncAddress);

                    var deviceptr = GetVTableFuncAddress(_device, VTableIndexes.D3D11DeviceRelease);
                    _deviceRelease = Marshal.GetDelegateForFunctionPointer<VTableFuncDelegate>(deviceptr);

                    var contex = GetVTableFuncAddress(d3DDevicePtr, VTableIndexes.D3D11DeviceContextRelease);
                    _deviceContextRelease = Marshal.GetDelegateForFunctionPointer<VTableFuncDelegate>(contex);
                }
            }
        }

i personally use a generic hook that determines the d3d device when loaded, and applies the correct detour. Make sure to use IntPtr.Size for your vtables as to ensure x32/62 compatibly.

I think yours would look something like this

Code:

    public class D3D11Hook : D3DHook
    {
        private DxgiSwapChainPresentDelegate _presentCallBack;
        private Detour _presentDetour;

        protected override void OnInitialize()
        {
            _presentCallBack = Dirext3D.HookAddress.ToDelegate<DxgiSwapChainPresentDelegate>();

            _presentDetour = Detour("Present", _presentCallBack,
                new DxgiSwapChainPresentDelegate(OnPresent), false);

            base.OnInitialize();
        }

        private int OnPresent(IntPtr device, int syncInterval, int flags)
        {
            UpdateFrame();
            return (int) _presentDetour.CallOriginal(device, syncInterval, flags);
        }

        [UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Unicode, SetLastError = true)]
        protected delegate int DxgiSwapChainPresentDelegate(IntPtr swapChainPtr, int syncInterval, int flags);

        [UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Unicode, SetLastError = true)]
        protected delegate int DxgiSwapChainResizeTargetDelegate(
            IntPtr swapChainPtr, ref D3D11Device.ModeDescription newTargetParameters);
    }

**-Ryuk-** · 09-23-2016

Hi lolp1, Thanks for the input... however as explained in my original post, I already have the hook which in your example is called OnPresent in mine its Callback

What you call 'device' in this function I believe to be the swapChainPointer, I need to be able to draw with this and therefore need the real device pointer used for the game (not the one I created) to get the address to hook.

I have no other use for the hook, I don't need it as a 'pulse' it is purely for rendering my own graphics.

If you have an example of drawing even if just a 2d line across the screen with the wow d3d11 device id be interested to see this.

**DarkLinux** · 09-23-2016

I use,

Code:

HRESULT hr = pSwapChain->GetDevice(__uuidof(ID3D11Device), (void**)&pDevice);

but that's in C++ and not using SlimDX

**lolp1** · 09-23-2016

Originally Posted by -Ryuk-

Hi lolp1, Thanks for the input... however as explained in my original post, I already have the hook which in your example is called OnPresent in mine its Callback

What you call 'device' in this function I believe to be the swapChainPointer, I need to be able to draw with this and therefore need the real device pointer used for the game (not the one I created) to get the address to hook.

I have no other use for the hook, I don't need it as a 'pulse' it is purely for rendering my own graphics.

If you have an example of drawing even if just a 2d line across the screen with the wow d3d11 device id be interested to see this.

I do too, sorry if it was confusing. I'll send you an example in PM tomorrow of how I render my radar.

**-Ryuk-** · 09-23-2016

Originally Posted by lolp1

I do too, sorry if it was confusing. I'll send you an example in PM tomorrow of how I render my radar.

Great. Thanks

**zdohdds** · 12-02-2016

Hi all. Trying to write DXGI::Present_hook for x64, it works, but crashes after 10 - 180 seconds.

PHP Code:


    public interface IPulsable 
    { 
        void DXGI_Present(); 
    }

PHP Code:


    public static class DirectX 
    { 
        private const int VMT_PRESENT = 8; 
 
        private static List<IPulsable> _pulsables = new List<IPulsable>(); 
 
        private static DxgiSwapChainPresentDelegate _present = null; 
        private static Detour _presentHook = null; 
 
        public static void Initialize() 
        { 
            IntPtr pPresent = IntPtr.Zero; 
 
            using (var renderForm = new SlimDX.Windows.RenderForm()) 
            { 
                var description = new SlimDX.DXGI.SwapChainDescription() 
                { 
                    BufferCount = 1, 
                    Flags = SlimDX.DXGI.SwapChainFlags.None, 
                    IsWindowed = true, 
                    ModeDescription = new SlimDX.DXGI.ModeDescription(100, 100, new SlimDX.Rational(60, 1), SlimDX.DXGI.Format.R8G8B8A8_UNorm), 
                    OutputHandle = renderForm.Handle, 
                    SampleDescription = new SlimDX.DXGI.SampleDescription(1, 0), 
                    SwapEffect = SlimDX.DXGI.SwapEffect.Discard, 
                    Usage = SlimDX.DXGI.Usage.RenderTargetOutput 
                }; 
                SlimDX.Direct3D11.Device device; 
                SlimDX.DXGI.SwapChain swapChain; 
                var result = SlimDX.Direct3D11.Device.CreateWithSwapChain( 
                    SlimDX.Direct3D11.DriverType.Hardware, 
                    SlimDX.Direct3D11.DeviceCreationFlags.None, 
                    description, 
                    out device, 
                    out swapChain); 
                if (result.IsSuccess) using (device) using (swapChain) 
                { 
                    // 8 * 4 = 0x20 for x86 
                    // 8 * 8 = 0x40 for x64 
                    IntPtr pointer = new IntPtr( Memory.Read<long>(swapChain.ComPointer) + VtableFunc(VMT_PRESENT) ); 
                    pPresent = new IntPtr(Memory.Read<long>(pointer)); 
                } 
            } 
 
            _present = Memory.RegisterDelegat<DxgiSwapChainPresentDelegate>(pPresent); 
            _presentHook = Detour.CreateAndApply(_present, new DxgiSwapChainPresentDelegate(DXGI_Present)); 
        } 
 
        private static int VtableFunc(int index) 
        { 
            return IntPtr.Size * index; 
        } 
 
        private static int DXGI_Present(IntPtr swapChainPtr, int syncInterval, int flags) 
        { 
            //foreach (var pulsable in _pulsables) 
               // pulsable.DXGI_Present(); 
            //Log.WriteLine("In DXGI_Present"); 
            return (int)_presentHook.CallOriginal(swapChainPtr, syncInterval, flags); 
        } 
 
        public static void RegisterCallBack(IPulsable pulsable) 
        { 
            _pulsables.Add(pulsable); 
        } 
 
        [UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Unicode, SetLastError = true)] 
        delegate int DxgiSwapChainPresentDelegate(IntPtr swapChainPtr, int syncInterval, int flags); 
         
        //public static IntPtr D3D11Present { get { return IntPtr.Add(Memory.ModuleBaseAddress("dxgi.dll"), 0x11A0); } } 
        //public static Delegate Present { get { return Memory.RegisterDelegat<DxgiSwapChainPresentDelegate>(D3D11Present); } } 
    }

PHP Code:


    public class Detour 
    { 
        private IntPtr _original; 
        private IntPtr _hook; 
        private byte[] _originalBytes; 
        private byte[] _hookBytes; 
 
        private Delegate _func_original; 
         
        public Detour(Delegate func_original, Delegate func_hook) 
        { 
            this._hook = Marshal.GetFunctionPointerForDelegate(func_hook); 
            List<byte> hookOpCode = new List<byte>(); 
            hookOpCode.AddRange(new byte[] { 0x48, 0xb8 }); // movabs rax 
            hookOpCode.AddRange(BitConverter.GetBytes(this._hook.ToInt64())); // address 
            hookOpCode.AddRange(new byte[] { 0xff, 0xe0 }); // jmp rax 
            this._hookBytes = hookOpCode.ToArray(); 
 
            this._original = Marshal.GetFunctionPointerForDelegate(func_original); 
            this._originalBytes = Memory.ReadBytes(this._original, hookOpCode.Count); 
            this._func_original = func_original; 
        } 
 
        public static Detour CreateAndApply(Delegate func_original, Delegate func_hook) 
        { 
            Detour ret = new Detour(func_original, func_hook); 
            if (ret != null) 
            { 
                ret.Apply(); 
            } 
            return ret; 
        } 
 
        public void Apply() 
        { 
            Memory.WriteBytes(this._original, this._hookBytes); 
             
        } 
 
        public void Remove() 
        { 
            Memory.WriteBytes(this._original, this._originalBytes); 
        } 
 
        public object CallOriginal(params object[] args) 
        { 
            Remove(); 
            object ret = _func_original.DynamicInvoke(args); 
            Apply(); 
            return ret; 
        } 
    }

With exception:

Code:

Exception handler died
Original exception:
0xE0434352 (unknown exception) at 00007ffd49701f28

What could it be?

**lolp1** · 12-02-2016

Are you sure the code you are calling in the detour is safe? What if you just do a frame count?

Try something like this.

Code:

    public class D3D11Hook : D3DHook
    {
        DxgiSwapChainPresentDelegate _presentCallBack;
        Detour _presentDetour;

        protected override void OnInitialize()
        {
            _presentCallBack = Dirext3D.HookAddress.ToDelegate<DxgiSwapChainPresentDelegate>();

            _presentDetour = Detour("Present", _presentCallBack,
                new DxgiSwapChainPresentDelegate(OnPresent), false);

            base.OnInitialize();
        }

        int OnPresent(IntPtr device, int syncInterval, int flags)
        {
            UpdateFrame();
            return (int) _presentDetour.CallOriginal(device, syncInterval, flags);
        }

        [UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Unicode, SetLastError = true)]
        protected delegate int DxgiSwapChainPresentDelegate(IntPtr swapChainPtr, int syncInterval, int flags);

        [UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Unicode, SetLastError = true)]
        protected delegate int DxgiSwapChainResizeTargetDelegate(
            IntPtr swapChainPtr, ref D3D11Device.ModeDescription newTargetParameters);
    }

    public static class FrameCounterTest
    {
        static readonly D3D11Hook D3D11Hook = new D3D11Hook();

        public static void Test()
        {
            D3D11Hook.Initialize();
            D3D11Hook.Frame += D3D11HookOnFrame;
        }

        public static int FrameCount { get; private set; }

        static void D3D11HookOnFrame(object sender, DeltaTimeEventArgs deltaTimeEventArgs)
        {
            if (FrameCount != 60)
            {
                FrameCount++;
                return;
            }

            FrameCount = 0;
            Log.WriteLine(FrameCount + " was reached");
        }
    }

**zdohdds** · 12-03-2016

Originally Posted by lolp1

Are you sure the code you are calling in the detour is safe? What if you just do a frame count?

Try something like this.

Code:

    public class D3D11Hook : D3DHook
    {
        DxgiSwapChainPresentDelegate _presentCallBack;
        Detour _presentDetour;

        protected override void OnInitialize()
        {
            _presentCallBack = Dirext3D.HookAddress.ToDelegate<DxgiSwapChainPresentDelegate>();

            _presentDetour = Detour("Present", _presentCallBack,
                new DxgiSwapChainPresentDelegate(OnPresent), false);

            base.OnInitialize();
        }

        int OnPresent(IntPtr device, int syncInterval, int flags)
        {
            UpdateFrame();
            return (int) _presentDetour.CallOriginal(device, syncInterval, flags);
        }

        [UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Unicode, SetLastError = true)]
        protected delegate int DxgiSwapChainPresentDelegate(IntPtr swapChainPtr, int syncInterval, int flags);

        [UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Unicode, SetLastError = true)]
        protected delegate int DxgiSwapChainResizeTargetDelegate(
            IntPtr swapChainPtr, ref D3D11Device.ModeDescription newTargetParameters);
    }

    public static class FrameCounterTest
    {
        static readonly D3D11Hook D3D11Hook = new D3D11Hook();

        public static void Test()
        {
            D3D11Hook.Initialize();
            D3D11Hook.Frame += D3D11HookOnFrame;
        }

        public static int FrameCount { get; private set; }

        static void D3D11HookOnFrame(object sender, DeltaTimeEventArgs deltaTimeEventArgs)
        {
            if (FrameCount != 60)
            {
                FrameCount++;
                return;
            }

            FrameCount = 0;
            Log.WriteLine(FrameCount + " was reached");
        }
    }

Thanks for the quick response. I haven't tried what you suggested, but "ugly code" works on all of 200% and without lunch breaks.

PHP Code:


        //_present = Memory.RegisterDelegat<DxgiSwapChainPresentDelegate>(pPresent);
        //_presentHook = Detour.CreateAndApply(pPresent, new DXGI_Present_Delegate(DXGI_Present));
        //...

        private static void DXGI_Present(IntPtr swapChainPtr, int syncInterval, int flags)
        {
            _presentHook.Dispose();

            foreach (var pulsable in _pulsables)
                pulsable.DXGI_Present();
            Log.WriteLine("{0:X}", swapChainPtr.ToInt64());

            _present.DynamicInvoke(swapChainPtr, syncInterval, flags);
            _presentHook.Apply();
        }
        delegate void DXGI_Present_Delegate(IntPtr swapChainPtr, int syncInterval, int flags);

PHP Code:


    public class Detour
    {
        private IntPtr _originalAddress;
        private IntPtr _hookAddress;
        private byte[] _originalOpCodes;
        private byte[] _hookOpCodes;

        private Delegate _func;

        public Detour(IntPtr address, Delegate func)
        {
            this._func = func;
            this._hookAddress = Marshal.GetFunctionPointerForDelegate(func);
            List<byte> hookOpCode = new List<byte>();
            hookOpCode.AddRange(new byte[] { 0x48, 0xb8 }); // movabs rax
            hookOpCode.AddRange(BitConverter.GetBytes(this._hookAddress.ToInt64())); // address
            hookOpCode.AddRange(new byte[] { 0xff, 0xe0 }); // jmp rax
            this._hookOpCodes = hookOpCode.ToArray();

            this._originalAddress = address;
            this._originalOpCodes = Memory.ReadBytes(address, hookOpCode.Count);
        }

        public static Detour CreateAndApply(IntPtr address, Delegate func)
        {
            Detour ret = new Detour(address, func);
            if (ret != null)
            {
                ret.Apply();
            }
            return ret;
        }

        public void Apply()
        {
            Memory.WriteBytes(this._originalAddress, this._hookOpCodes);

        }

        public void Dispose()
        {
            Memory.WriteBytes(this._originalAddress, this._originalOpCodes);
        }

        public object CallOriginal(params object[] args)
        {
            Dispose();
            object ret = _func.DynamicInvoke(args);
            Apply();
            return ret;
        }
    }

If I try to use CallOriginal (in the previous Detour example, not this) function it crashes.

**Jadd** · 12-03-2016

Originally Posted by zdohdds

Hi all. Trying to write DXGI::Present_hook for x64, it works, but crashes after 10 - 180 seconds.

...

PHP Code:


    public class Detour
    {
        private IntPtr _original;
        private IntPtr _hook;
        private byte[] _originalBytes;
        private byte[] _hookBytes;

        private Delegate _func_original;
        
        public Detour(Delegate func_original, Delegate func_hook)
        {
            this._hook = Marshal.GetFunctionPointerForDelegate(func_hook);
            List<byte> hookOpCode = new List<byte>();
            hookOpCode.AddRange(new byte[] { 0x48, 0xb8 }); // movabs rax
            hookOpCode.AddRange(BitConverter.GetBytes(this._hook.ToInt64())); // address
            hookOpCode.AddRange(new byte[] { 0xff, 0xe0 }); // jmp rax
            this._hookBytes = hookOpCode.ToArray();

            this._original = Marshal.GetFunctionPointerForDelegate(func_original);
            this._originalBytes = Memory.ReadBytes(this._original, hookOpCode.Count);
            this._func_original = func_original;
        }

        ...
    }

With exception:

Code:

Exception handler died
Original exception:
0xE0434352 (unknown exception) at 00007ffd49701f28

What could it be?

You need to pin the destination delegate or the GC will eventually dispose of it since it is never explicitly stored or referenced after Marshal.GetFunctionPointerForDelegate. If and when this happens, your jmp will send you to a delegate which no longer exists.

Add a new field, _destination, and assign func_hook to it when you create the detour. Even though you'll never need to use it again, the GC will not dispose of it or move it's memory location.

**imzz** · 07-30-2018

Originally Posted by zdohdds

Thanks for the quick response. I haven't tried what you suggested, but "ugly code" works on all of 200% and without lunch breaks.

PHP Code:


        //_present = Memory.RegisterDelegat<DxgiSwapChainPresentDelegate>(pPresent);
        //_presentHook = Detour.CreateAndApply(pPresent, new DXGI_Present_Delegate(DXGI_Present));
        //...

        private static void DXGI_Present(IntPtr swapChainPtr, int syncInterval, int flags)
        {
            _presentHook.Dispose();

            foreach (var pulsable in _pulsables)
                pulsable.DXGI_Present();
            Log.WriteLine("{0:X}", swapChainPtr.ToInt64());

            _present.DynamicInvoke(swapChainPtr, syncInterval, flags);
            _presentHook.Apply();
        }
        delegate void DXGI_Present_Delegate(IntPtr swapChainPtr, int syncInterval, int flags);

PHP Code:


    public class Detour
    {
        private IntPtr _originalAddress;
        private IntPtr _hookAddress;
        private byte[] _originalOpCodes;
        private byte[] _hookOpCodes;

        private Delegate _func;

        public Detour(IntPtr address, Delegate func)
        {
            this._func = func;
            this._hookAddress = Marshal.GetFunctionPointerForDelegate(func);
            List<byte> hookOpCode = new List<byte>();
            hookOpCode.AddRange(new byte[] { 0x48, 0xb8 }); // movabs rax
            hookOpCode.AddRange(BitConverter.GetBytes(this._hookAddress.ToInt64())); // address
            hookOpCode.AddRange(new byte[] { 0xff, 0xe0 }); // jmp rax
            this._hookOpCodes = hookOpCode.ToArray();

            this._originalAddress = address;
            this._originalOpCodes = Memory.ReadBytes(address, hookOpCode.Count);
        }

        public static Detour CreateAndApply(IntPtr address, Delegate func)
        {
            Detour ret = new Detour(address, func);
            if (ret != null)
            {
                ret.Apply();
            }
            return ret;
        }

        public void Apply()
        {
            Memory.WriteBytes(this._originalAddress, this._hookOpCodes);

        }

        public void Dispose()
        {
            Memory.WriteBytes(this._originalAddress, this._originalOpCodes);
        }

        public object CallOriginal(params object[] args)
        {
            Dispose();
            object ret = _func.DynamicInvoke(args);
            Apply();
            return ret;
        }
    }

If I try to use CallOriginal (in the previous Detour example, not this) function it crashes.

Is your problem solved?

Shout-Out

User Tag List

Thread: DirectX11 Hook and Render

Thread Tools

Search Thread

DirectX11 Hook and Render

Similar Threads

[C++] Endscene hook and dostring code inject and wow crashed....

DR Hooks and Detection

[Rate] Sig and Render

[Showoff] Simple Batman Signature, and render!

Brushes and Renders

OwnedCore Forums

casino

CoreCoins

My OwnedCore

About Us

Casino