Problem with DirectX CreateDevice Hooking

**rik.chong** · 11-27-2012

Hi,

I'm trying to Hook CreateDevice (using Dll Injection), but it didn't got called.
Direct3DCreate is called twice, here's the log:

[22:40:54]: Direct3DCreate9( 32 ) got called, result: 0x00DC2280
[22:40:54]: Adding a detour at 0x6DBFF52D(0x6CF718A

, name: CreateDevice
[22:40:54]: Direct3DCreate9( 32 ) got called, result: 0x00DC2280

The code below is executed after my own dll is loaded (HookD3D), any idea??

Code:

typedef long ( WINAPI * tCreateDevice )( IDirect3D9 * pThis, UINT Adapter, DWORD DeviceType, HWND hFocusWindow, DWORD BehaviorFlags, void * pPresentationParameters, IDirect3DDevice9 ** ppReturnedDeviceInterface );
tCreateDevice oCreateDevice = 0;

long WINAPI hook_CreateDevice( IDirect3D9 * pThis, UINT Adapter, DWORD DeviceType, HWND hFocusWindow, DWORD BehaviorFlags, void * pPresentationParameters, IDirect3DDevice9 ** ppReturnedDeviceInterface )
{
	HRESULT hResult = oCreateDevice( pThis, Adapter, DeviceType, hFocusWindow, BehaviorFlags, pPresentationParameters, ppReturnedDeviceInterface );
	DBGLOG( "oCreateDevice got called, window handle: 0x%08X\n", hResult, hFocusWindow );
	IDirect3DDevice9 * pDevice = *ppReturnedDeviceInterface;

	gpWoWX->SetWindowHandle( hFocusWindow );
	
	return hResult;
}

typedef void * ( __stdcall * tDirect3DCreate9 )( UINT SDKVersion );
tDirect3DCreate9 oDirect3DCreate9 = 0;

void * WINAPI hook_Direct3DCreate9( UINT SDKVersion )
{
	void * pDirect3D = oDirect3DCreate9( SDKVersion );
	
	DBGLOG( "Direct3DCreate9( %i ) got called, result: 0x%08X\n", SDKVersion, pDirect3D );

	if( !gpWoWX->GetPatcher()->GetPatchByName( "CreateDevice" ) )
	{
		/*
			012D747D   8B0E             MOV ECX,DWORD PTR DS:[ESI]               ; d3d9.6DE906D0
			012D747F   8B51 40          MOV EDX,DWORD PTR DS:[ECX+40]
		*/
		oCreateDevice = *(tCreateDevice*)( *(DWORD*)pDirect3D + 0x40 );
		gpWoWX->GetPatcher()->AddDetour( &(PVOID&)oCreateDevice, (PBYTE)hook_CreateDevice, "CreateDevice" );
	}

	return pDirect3D;
}

void HookD3D()
{

	HMODULE hD3d9 = LoadLibraryA( "d3d9.dll" );

	if( !hD3d9 )
	{
		MessageBoxA( 0, "d3d9.dll couldn't be loaded.", "Fatal error", 0 );
		ExitProcess( 0 );
		return;
	}

	oDirect3DCreate9 = (tDirect3DCreate9)GetProcAddress( hD3d9, "Direct3DCreate9" );
	gpWoWX->GetPatcher()->AddDetour( &(PVOID&)oDirect3DCreate9, (PBYTE)hook_Direct3DCreate9, "Direct3DCreate9" );

	DBGLOG( "D3D initialized\n" );
}

**boredevil** · 11-28-2012

you could try to igore the first call and apply your detour when it gets hit the second time. don´t ask why i don´t know. but that did the trick for a friend of mine

**DarkLinux** · 11-28-2012

Set a breakpoint and go line by line and see if your detour is working... I'm lazy and use Microsoft Detours

Take a look how I do it if you want http://www.ownedcore.com/forums/worl...n-scanner.html (EverScan - An Open Source Warden Scanner)

Also I cant really tell but are you detouring it from the vtable? Sounds like your detouring it on a specific call...