C++ D3D挂钩 - COM vtable

Question

尝试制作一个类似Fraps的程序。请查看注释以了解其失败之处。

#include "precompiled.h"

typedef IDirect3D9* (STDMETHODCALLTYPE* Direct3DCreate9_t)(UINT SDKVersion);
Direct3DCreate9_t RealDirect3DCreate9 = NULL;

typedef HRESULT (STDMETHODCALLTYPE* CreateDevice_t)(UINT Adapter, D3DDEVTYPE DeviceType, HWND hFocusWindow,
    DWORD BehaviorFlags, D3DPRESENT_PARAMETERS* pPresentationParameters,
    IDirect3DDevice9** ppReturnedDeviceInterface);
CreateDevice_t RealD3D9CreateDevice = NULL;

HRESULT STDMETHODCALLTYPE HookedD3D9CreateDevice(UINT Adapter, D3DDEVTYPE DeviceType, HWND hFocusWindow,
    DWORD BehaviorFlags, D3DPRESENT_PARAMETERS* pPresentationParameters,
    IDirect3DDevice9** ppReturnedDeviceInterface)
{
    // this call makes it jump to HookedDirect3DCreate9 and crashes. i'm doing something wrong
    HRESULT ret = RealD3D9CreateDevice(Adapter, DeviceType, hFocusWindow, BehaviorFlags,
        pPresentationParameters, ppReturnedDeviceInterface);

    return ret;
}

IDirect3D9* STDMETHODCALLTYPE HookedDirect3DCreate9(UINT SDKVersion)
{
    MessageBox(0, L"Creating d3d", L"", 0);

    IDirect3D9* d3d = RealDirect3DCreate9(SDKVersion);

    UINT_PTR* pVTable = (UINT_PTR*)(*((UINT_PTR*)d3d));
    RealD3D9CreateDevice = (CreateDevice_t)pVTable[16];

    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    DetourAttach(&(PVOID&)RealD3D9CreateDevice, HookedD3D9CreateDevice);
    if (DetourTransactionCommit() != ERROR_SUCCESS)
    {
        MessageBox(0, L"failed to create createdev hook", L"", 0);
    }

    return d3d;
}

bool APIENTRY DllMain(HINSTANCE hModule, DWORD fdwReason, LPVOID lpReserved)
{
    if (fdwReason == DLL_PROCESS_ATTACH)
    {
        MessageBox(0, L"", L"", 0);

        RealDirect3DCreate9 = (Direct3DCreate9_t)GetProcAddress(GetModuleHandle(L"d3d9.dll"), "Direct3DCreate9");

        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)RealDirect3DCreate9, HookedDirect3DCreate9);
        DetourTransactionCommit();
    }

    // TODO detach hooks

    return true;
}

- Mango

Answer 1

IDirect3D9::CreateDevice 的 C 接口签名如下：

STDMETHOD(CreateDevice)(
    THIS_ 
    UINT Adapter,D3DDEVTYPE DeviceType,HWND hFocusWindow,
    DWORD BehaviorFlags,D3DPRESENT_PARAMETERS* pPresentationParameters,
    IDirect3DDevice9** ppReturnedDeviceInterface) PURE;

它会被扩展为：

typedef HRESULT (STDMETHODCALLTYPE* CreateDevice_t)(
    IDirect3D9 FAR *This, // you forgot this.
    UINT Adapter, D3DDEVTYPE DeviceType, HWND hFocusWindow, 
    DWORD BehaviorFlags, D3DPRESENT_PARAMETERS* pPresentationParameters, 
    IDirect3DDevice9** ppReturnedDeviceInterface); 

换句话说，你声明了 CreateDevice 的惰性计算方式有误。

此外，你可以使用 #define CINTERFACE，而不是直接索引到 IDirect3D9 的虚函数表中，通过 d3d->lpVtbl->CreateDevice 访问你想要覆盖的函数。

- MSN

---

抱歉，前几天我无法注册。现已注册并接受了答案。再次感谢。 - Mango