Jump to content

  • Log In with Google      Sign In   
  • Create Account

[C++] Direct3D hooking sample


Old topic!
Guest, the last post of this topic is over 60 days old and at this point you may not reply in this topic. If you wish to continue this conversation start a new topic.

  • You cannot reply to this topic
32 replies to this topic

#1 Muhammad Haggag   Moderators   -  Reputation: 1357

Like
0Likes
Like

Posted 22 November 2005 - 11:55 PM

Intro This sample demonstrates the second technique that can be used to render content on-top of other Direct3D applications. The first technique, overlays, is rather general purpose; it is not tied to Direct3D. You can use overlays to render on-top of everything. This technique, on the other hand, is closely tied to Direct3D. Due to its special-purpose nature, you lose some benefits and gain others. What you lose is that you can only draw on-top of Direct3D9 applications. What you gain is that you become Direct3D itself, so you're not limited to just drawing anymore. You can do things like count the number of batches submitted per frame, the number of triangles, replace textures, etc. In this sample, we use Windows hooks to inject our DLL code into a specific process - the target process - that uses Direct3D9. Our injected code replaces Direct3DCreate9 with our own function that calls the standard Direct3DCreate9, but returns our implementation of IDirect3D9, MyDirect3D9. MyDirect3D9 stores a pointer to the original IDirect3D9 interface, so you can do anything you like by forwarding the function calls you don’t want to change and rewriting the ones you want to. The actual hooking is done using APIHijack, with very minor modifications to make it build under VC++ 2003 and 2005. Namely, a couple of reinterpret_cast’s here and there. The sample is divided into 2 projects: A DLL containing interface implementations and APIHijack, and a launcher console application. Visual C++ 2003 and 2005 solutions are provided. The launcher is a simple Unicode application that sets up the single piece of information that the DLL needs: The target process name. In order to make things simple, the launcher is passed the target process name (i.e. exe name) as a command-line argument. It then creates or updates a registry key, HKEY_CURRENT_USER\Software\Direct3D-Hook, to store the name in its default value. The non-Unicode DLL, whose DllMain is entered whenever a process is loaded, compares the name of the loaded process to that in the registry and hooks Direct3D if they’re the same. It also gives an info beep on hooking. The DLL was not build with Unicode because APIHijack isn't, and I'm not interested in converting it. Feel free to do so if you want. I’ve only provided implementations for the interfaces IDirect3D9 and IDirect3DDevice9. You can implement any other interfaces if you like, provided that you modify the functions that create them to return a pointer to instances of your implementation. Keep in mind, though, that it’s a quite boring process. I nearly lost an arm and a leg writing the aforementioned implementations, even though I’ve copied the function declarators from the d3d9.h header file. You’ll understand when you see the code. [smile] The IDirect3D9 interface implementation is rather minimal, so it forwards all function calls except: 1. Release. We call IDirect3D9::Release and check its return value. If its zero, we delete the MyDirect3D9 instance. If we don’t do this, we’ll leak memory. 2. CreateDevice. We create a normal device but return our own implementation of IDirect3DDevice9, MyDirect3DDevice9. The device implementation, again, forwards all of the function calls except: a) Release, for the same reason as above. b) EndScene. This is where we can do all the rendering we want. The sample renders a colored quad to the top-left of the render-target. Limitations Applications that manually load D3D9.dll via LoadLibrary, retrieve a pointer to Direct3DCreate9 using GetProcAddress and call it will NOT be hooked. All Direct3D SDK samples do this. If you really want to hook them, you can probably do it in another way, by providing your D3D9.dll and putting it in the same folder. I might try that out later. Testing To test the sample, I used 2 applications. A build of Direct3D tutorial #2, “Vertices”, was used first. It worked fine, and it is included in the sample. To test it in a real-world scenario, though, I used the brilliant, addictive game: “Egyptian Addiction”. Yes, this is free advertising. Go give that game a try, it rocks. No, it’s not developed by Egyptians. The real-world test was useful in that it reminded me that I had to set the required render and texture stage states first. Don’t forget that there’s someone playing with the settings before you [smile]. The sample doesn’t restore the state after modifying it, assuming the hooked process sets its required states every time. This can break some applications where the application writers didn’t expect their states changing behind their back. You’ll need to cache all state changes on all the state changing calls, and revert to the cached ones after rendering if you’re dealing with such an application. License My code in this sample is public domain, do whatever you wish with it. I can’t say the same for the APIHijack library, however. The author does not mention any specific license in his code or article, so you’d probably want to contact him if you’re doing a commercial project. PICTARS!! Finally, screenshot time!

Sponsor:

#2 Dave   Members   -  Reputation: 1527

Like
0Likes
Like

Posted 23 November 2005 - 12:02 AM

This is great and much needed since there have been so many "How do i's...".

PRAISE TO YAW!!!

#3 jollyjeffers   Crossbones+   -  Reputation: 1542

Like
0Likes
Like

Posted 23 November 2005 - 02:11 AM



I've never had the time to look into API hooking in much detail, but I've always been curious how it actually worked. I shall be sure to have a look through your code as/when I get some time [smile]

Cheers!
Jack
<hr align="left" width="25%" />
Jack Hoxley <small>[</small><small> Forum FAQ | Revised FAQ | MVP Profile | Developer Journal ]</small>

#4 circlesoft   Members   -  Reputation: 1174

Like
0Likes
Like

Posted 24 November 2005 - 10:17 AM

Niiiiiice, this is quality work. If I only had a dollar for each time I answered a "hooking" question, I would be a BAZILIONIONAIRE!!! Gotta love the tediousness of inheriting IDirect3DDevice9...there are only like 14 trillion member functions.

Dustin Franklin ( circlesoft :: KBase :: Mystic GD :: ApolloNL )

#5 Muhammad Haggag   Moderators   -  Reputation: 1357

Like
0Likes
Like

Posted 24 November 2005 - 05:42 PM

Quote:
Original post by circlesoft
Niiiiiice, this is quality work. If I only had a dollar for each time I answered a "hooking" question, I would be a BAZILIONIONAIRE!!!

No need to be modest, we all know you already are!

Quote:
Gotta love the tediousness of inheriting IDirect3DDevice9...there are only like 14 trillion member functions.

Yes, seriously. I almost broke my fingers on this one.

#6 Leadorn   Members   -  Reputation: 100

Like
0Likes
Like

Posted 27 November 2005 - 10:47 AM

I did something similar with IDirectPlay8Client. Took a while getting it to work but now i have nice send/recv sniffer for combat flight simulator 3 and all other games using directplay8client.



#7 Promit   Moderators   -  Reputation: 7587

Like
0Likes
Like

Posted 27 November 2005 - 11:19 AM

Wow, this is awesome. I intend to have some fun with this. I enjoyed hooking OpenGL and writing wallhacks for HL1 and its mods*. Let's see what I can do with this. And, kudos for typing out all those functions. There sure are a lot...

* Of course I don't play publically with the hacks. I rather happen to enjoy writing them, is all.

#8 jollyjeffers   Crossbones+   -  Reputation: 1542

Like
0Likes
Like

Posted 28 November 2005 - 06:02 AM

I'm wondering if there is some sort of image-analysis tool that can be built on top of this sort of technology.

If you could hook a commercial game and count the number of shaders used, number of passes, overdraw complexity and so on... would be an interesting thing to mess with if nothing else.

Make it work well and the hardware-nuts would love it - they spend enough time talking about clockspeeds and megahurtz that I'm sure they'll have good fun with a screenshot of the shader-complexity of a commercial game [lol]

Jack
<hr align="left" width="25%" />
Jack Hoxley <small>[</small><small> Forum FAQ | Revised FAQ | MVP Profile | Developer Journal ]</small>

#9 circlesoft   Members   -  Reputation: 1174

Like
0Likes
Like

Posted 28 November 2005 - 06:46 AM

Quote:
Original post by jollyjeffers
I'm wondering if there is some sort of image-analysis tool that can be built on top of this sort of technology.

If you could hook a commercial game and count the number of shaders used, number of passes, overdraw complexity and so on... would be an interesting thing to mess with if nothing else.

Make it work well and the hardware-nuts would love it - they spend enough time talking about clockspeeds and megahurtz that I'm sure they'll have good fun with a screenshot of the shader-complexity of a commercial game [lol]

Jack

That would be quite easy...just hook into IDirect3DDevice9::SetVertexShader() and IDirect3DDevice9::SetPixelShader(). Then count up how many changes you have per frame. You can do *all* kinds of performance analysis like that.

p.s. IIRC the effect framework still uses Set*Shader() in its underlying implementation

Dustin Franklin ( circlesoft :: KBase :: Mystic GD :: ApolloNL )

#10 Promit   Moderators   -  Reputation: 7587

Like
0Likes
Like

Posted 28 November 2005 - 06:57 AM

Maybe I'm missing something here, but isn't that exactly what PIX does?

#11 DirectXFreak   Members   -  Reputation: 166

Like
0Likes
Like

Posted 28 November 2005 - 07:07 AM

Wow! This is really cool!
You should make this an article =P

[Edited by - DirectXFreak on November 28, 2005 5:07:07 PM]

#12 circlesoft   Members   -  Reputation: 1174

Like
0Likes
Like

Posted 28 November 2005 - 07:13 AM

Quote:
Original post by Promit
Maybe I'm missing something here, but isn't that exactly what PIX does?

D'oh...

I just tried that using PIX on GTA: San Andreas. Some sample stats:


DrawPrim............32
DrawIndexedPrim.....160
VB Locks............45
IB Locks............13
SetRenderState......163
SetTexture..........190
SetVertexShader.....6
SetPixelShader......0
SetRenderTarget.....12


Considering that this was a really simple scene (just inside the main characters house, very low complexity) I think those numbers are high.

#13 jollyjeffers   Crossbones+   -  Reputation: 1542

Like
0Likes
Like

Posted 28 November 2005 - 08:32 AM

Quote:
Original post by Promit
Maybe I'm missing something here, but isn't that exactly what PIX does?

Yeah, essentially... I have to admit I haven't tried it, but you can't get PIX to generate an overdraw of the image, can you? deep pixel analysis yes, but not shader complexity and so on..?

The idea came from this thread. It'd be pretty awesome if you could somehow display the number of pixel shader arithmetic or texture instruction count per-pixel. Could make for a great performance debugging tool - the brighter the colours the more fill-rate related work you're doing etc...

Then again, hacking that in via hooking stands as much chance of breaking things as it does working [lol]

Oh, and the obvious advantage is that it'd be overlayed - giving immediate feedback rather than the capture full stream then analyse the data.

Jack
<hr align="left" width="25%" />
Jack Hoxley <small>[</small><small> Forum FAQ | Revised FAQ | MVP Profile | Developer Journal ]</small>

#14 DrGUI   Members   -  Reputation: 402

Like
0Likes
Like

Posted 02 December 2005 - 04:09 AM

Why might you need that many VB and IB locks per frame?
Was there a legendary particle system in the house or something?

#15 circlesoft   Members   -  Reputation: 1174

Like
0Likes
Like

Posted 02 December 2005 - 05:43 AM

Quote:
Original post by DrGUI
Why might you need that many VB and IB locks per frame?
Was there a legendary particle system in the house or something?


Yea, and this is inside a really simple house. I did some more investigating, and profiled a complex scene outside:


DIP Calls: 1300 - 2300 (:O !!!)
VB Locks: 120-145
IB Locks: 50-75

New VBs: 1-5
New IBs: 1-7

FPS: 10-20


Yea...so I wonder really what the frick is going on. Looks like someone at Rockstar needs to read the renown instancing slidedeck...

Dustin Franklin ( circlesoft :: KBase :: Mystic GD :: ApolloNL )

#16 Person   Members   -  Reputation: 138

Like
0Likes
Like

Posted 27 December 2005 - 09:02 AM

If I use that sample than AOE 3 hangs.
And nothing happened in COD 2.

#17 Jason Z   Crossbones+   -  Reputation: 5300

Like
0Likes
Like

Posted 27 December 2005 - 12:21 PM

Oh my. This could be used for some serious hacking of applications. Really, you could trace exactly how the api is used - frankly I think it is pretty cool but I am surprised that MS allows this type of thing to be done.

I think I am going to try a few experiments with my own engine and see if this can be used for some type of runtime analysis of my rendering calls. Great work, I appreciate your effort (and typing abilities!).

#18 circlesoft   Members   -  Reputation: 1174

Like
0Likes
Like

Posted 27 December 2005 - 01:33 PM

Quote:
Original post by Jason Z
Oh my. This could be used for some serious hacking of applications. Really, you could trace exactly how the api is used - frankly I think it is pretty cool but I am surprised that MS allows this type of thing to be done.

I think so, since they full support the ultimate "hacking" application - PIX. PIX makes it easy to analyze exactly what an application is doing, D3D-wise. IMO, after doing some trials on commercial games, it is more helpful than the hooking approach for profiling.

#19 Jason Z   Crossbones+   -  Reputation: 5300

Like
0Likes
Like

Posted 27 December 2005 - 02:24 PM

Holy Crap!

I just ran a test run of PIX on the latest build of my game. I tried using PIX long ago when it first came out and wasn't very impressed, but it has really evolved quite a bit from what I remember.

The object window alone is worth using, not to mention the frame rendering stream. So this will work with any D3D9 commercial application? I guess once you ship something you are essentially allowing everyone to see what you are doing - it kind of opens up the doors to smaller developers (like me!) to see what the big boys are doing.

Thats pretty cool.

#20 circlesoft   Members   -  Reputation: 1174

Like
0Likes
Like

Posted 27 December 2005 - 02:53 PM

Quote:
Original post by Jason Z
The object window alone is worth using, not to mention the frame rendering stream. So this will work with any D3D9 commercial application? I guess once you ship something you are essentially allowing everyone to see what you are doing - it kind of opens up the doors to smaller developers (like me!) to see what the big boys are doing.

Yea pretty much - they have worked on all commercial games I have tried it on (HL2, Farcry, GTA:SA). If you read a few posts above, I show some figures about GTA that are a little disturbing [crying]




Old topic!
Guest, the last post of this topic is over 60 days old and at this point you may not reply in this topic. If you wish to continue this conversation start a new topic.



PARTNERS