Direct3D, EndScene Detour

[headedtomexico]

I'm trying to add some models to an existing game. I'm injected into the game, and i've hooked the direct3d device succesfully. I tested this by setting the fill mode to wire frame and the game indeed changes to wire frame(I did have to add a clear to an endscene detour or else the wire-frames would leave "tracers").

I'm having a couple issues. One, for some reason my device is working kind of strange. For example, for me to turn the wireframe on, I have to do the following:

IDirect3DDevice9* Device = 0;
Device = (IDirect3DDevice9*)DeviceAddress;

//i have to use:
Device->lpVtbl->SetRenderState(Device,D3DRS_FILLMODE,3);
//instead of
Device->SetRenderState(D3DRS_FILLMODE,3);

Thats one of the minor problems, and I don't mind passing the "this" to the function manually, but it's kind of strange.

The real issue is, I've hooked the games EndScene(), and halt it momentarily so that I can read some vertices in but it isn't showing up in the game. When I click out of the game window and it goes into background mode and gets all choppy I can see my cube show up in flashes... When I toggle to wireframe mode I can see my cubes triangles... but for some reason in filled mode it just doesnt get seen.

#define D3DFVF_CUSTOMVERTEX ( D3DFVF_XYZ | D3DFVF_DIFFUSE )

IDirect3DDevice9* Device = 0;

LPDIRECT3DVERTEXBUFFER9 g_pVertexBuffer = NULL;

struct Vertex
{
    float x, y, z;
    DWORD color;
};

Vertex g_cubeVertices[] =
{
	{-1.0f, 1.0f,-1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	{ 1.0f, 1.0f,-1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	{-1.0f,-1.0f,-1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	{ 1.0f,-1.0f,-1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	
	{-1.0f, 1.0f, 1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	{-1.0f,-1.0f, 1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	{ 1.0f, 1.0f, 1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	{ 1.0f,-1.0f, 1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	
	{-1.0f, 1.0f, 1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	{ 1.0f, 1.0f, 1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	{-1.0f, 1.0f,-1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	{ 1.0f, 1.0f,-1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	
	{-1.0f,-1.0f, 1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	{-1.0f,-1.0f,-1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	{ 1.0f,-1.0f, 1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	{ 1.0f,-1.0f,-1.0f,  D3DCOLOR_XRGB(0, 0, 255) },

	{ 1.0f, 1.0f,-1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	{ 1.0f, 1.0f, 1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	{ 1.0f,-1.0f,-1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	{ 1.0f,-1.0f, 1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	
	{-1.0f, 1.0f,-1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	{-1.0f,-1.0f,-1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	{-1.0f, 1.0f, 1.0f,  D3DCOLOR_XRGB(0, 0, 255) },
	{-1.0f,-1.0f, 1.0f,  D3DCOLOR_XRGB(0, 0, 255) }
};

VOID enter()
{
    hookdevice(); 
    Device->lpVtbl->CreateVertexBuffer(Device, 24*sizeof(Vertex),0, D3DFVF_CUSTOMVERTEX, D3DPOOL_DEFAULT, &g_pVertexBuffer, NULL );
    void *pVertices = NULL;
    g_pVertexBuffer->lpVtbl->Lock(g_pVertexBuffer, 0, sizeof(g_cubeVertices), (void**)&pVertices, 0 );
    memcpy( pVertices, g_cubeVertices, sizeof(g_cubeVertices) );
    g_pVertexBuffer->lpVtbl->Unlock(g_pVertexBuffer);
}


VOID MyDevice::Detour_EndScene(VOID)
{
    Device->lpVtbl->SetStreamSource(Device, 0, g_pVertexBuffer, 0, sizeof(Vertex) );
    Device->lpVtbl->SetFVF(Device, D3DFVF_CUSTOMVERTEX );

    Device->lpVtbl->DrawPrimitive(Device, D3DPT_TRIANGLESTRIP,  0, 2 );
    Device->lpVtbl->DrawPrimitive(Device, D3DPT_TRIANGLESTRIP,  4, 2 );
    Device->lpVtbl->DrawPrimitive(Device, D3DPT_TRIANGLESTRIP,  8, 2 );
    Device->lpVtbl->DrawPrimitive(Device, D3DPT_TRIANGLESTRIP, 12, 2 );
    Device->lpVtbl->DrawPrimitive(Device, D3DPT_TRIANGLESTRIP, 16, 2 );
    Device->lpVtbl->DrawPrimitive(Device, D3DPT_TRIANGLESTRIP, 20, 2 );

    Real_EndScene();
}

I'd google, but i'm really not even sure what to look for... anyone have an guesses? I'll gladly give more details, I did dozens of attempts over the last 24hrs with slightly different outcomes.

[headedtomexico]

It may be worth noting that when I detour endscene, with an output to the screen of "TEST", I get spam. So it is hooking the function. If I also put code in there that halts every other endscene from taking place the graphics get all choppy. So i'm about 99% positive my hook works.

Here is the thing though, if I put an output of "TEST" in my beginscene()... or even present(), I get no output which I assume means that devices beginscene/present aren't being called.

[headedtomexico]

Ok, some more clues if anyone bothers with this thread.

I did a getswapchain, chain 0.
Then I did a present with just a bunch of NULLS.

This made my cube show up in game, but its flashing rapidly.

[TheRealOrder]

headedtomexico,
I generally do not help people understand hooking and reading dlls contents as it promotes the already massive number of game hacks out there. You have made it pretty far and are almost there though. Buffer 0 is the screen your drawing directly to in full screen mode and when you return from your hook the game finishes its endscene and presents the bachbuffer thereby drawing over your geometry. You need to get the current render target and draw to it, most have one back buffer so get buffer 1 (not 0). If the game is doubled buffered then the active buffer could be 1 or 2 currently being rendered to. You can query the current render target from the swapchain.

[headedtomexico]

Thanks for making an exception, i'll try that. I started reading through some swap chain stuff and saw that it has it's own present method and though that may be why the device->present wasn't firing.

This directx stuff is fascinating. I think i'm going to have to do some real in depth reading up on it.

I'll give your suggestion a shot. For the sake of your ethics, its for a emulated game and only realeased on servers that server op's have approved the mods.