3

I'm trying to hook the SetCooperativeLevel function in the DirectDraw object. My goal is very similar to the one in this question API Hook on a COM object function? however the only problem is that I don't know the exact offset in IDirectDraw's vtable for SetCooperativeLevel. Is there anyway to glean this from perhaps <ddraw.h> or programatically?

Here's the interface declaration for IDirectDraw, however I'm unsure how this corresponds to the vtable.

DECLARE_INTERFACE_( IDirectDraw, IUnknown )
{
    STDMETHOD(QueryInterface) (THIS_ REFIID riid, LPVOID FAR * ppvObj) PURE;
    STDMETHOD_(ULONG,AddRef) (THIS)  PURE;
    STDMETHOD_(ULONG,Release) (THIS) PURE;
    STDMETHOD(Compact)(THIS) PURE;
    STDMETHOD(CreateClipper)(THIS_ DWORD, LPDIRECTDRAWCLIPPER FAR*, IUnknown FAR * ) PURE;
    STDMETHOD(CreatePalette)(THIS_ DWORD, LPPALETTEENTRY, LPDIRECTDRAWPALETTE FAR*, IUnknown FAR * ) PURE;
    STDMETHOD(CreateSurface)(THIS_  LPDDSURFACEDESC, LPDIRECTDRAWSURFACE FAR *, IUnknown FAR *) PURE;
    STDMETHOD(DuplicateSurface)( THIS_ LPDIRECTDRAWSURFACE, LPDIRECTDRAWSURFACE FAR * ) PURE;
    STDMETHOD(EnumDisplayModes)( THIS_ DWORD, LPDDSURFACEDESC, LPVOID, LPDDENUMMODESCALLBACK ) PURE;
    STDMETHOD(EnumSurfaces)(THIS_ DWORD, LPDDSURFACEDESC, LPVOID,LPDDENUMSURFACESCALLBACK ) PURE;
    STDMETHOD(FlipToGDISurface)(THIS) PURE;
    STDMETHOD(GetCaps)( THIS_ LPDDCAPS, LPDDCAPS) PURE;
    STDMETHOD(GetDisplayMode)( THIS_ LPDDSURFACEDESC) PURE;
    STDMETHOD(GetFourCCCodes)(THIS_  LPDWORD, LPDWORD ) PURE;
    STDMETHOD(GetGDISurface)(THIS_ LPDIRECTDRAWSURFACE FAR *) PURE;
    STDMETHOD(GetMonitorFrequency)(THIS_ LPDWORD) PURE;
    STDMETHOD(GetScanLine)(THIS_ LPDWORD) PURE;
    STDMETHOD(GetVerticalBlankStatus)(THIS_ LPBOOL ) PURE;
    STDMETHOD(Initialize)(THIS_ GUID FAR *) PURE;
    STDMETHOD(RestoreDisplayMode)(THIS) PURE;
    STDMETHOD(SetCooperativeLevel)(THIS_ HWND, DWORD) PURE;    // I'm trying to hook this
    STDMETHOD(SetDisplayMode)(THIS_ DWORD, DWORD,DWORD) PURE;
    STDMETHOD(WaitForVerticalBlank)(THIS_ DWORD, HANDLE ) PURE;
};
Community
  • 1
  • 1
cplusplus
  • 614
  • 6
  • 14
  • 1
    Just count, starting at 0. So it is 20 * 4 for 32-bit code, 20 * 8 for 64-bit code. Watch out for inherited interfaces. This one only inherits IUnknown and already has its 3 methods listed. Not otherwise typical in IDL. – Hans Passant Apr 01 '12 at 06:58

1 Answers1

2

Answering my own question: The vtable is laid out in exactly the same order the interface functions are declared.

cplusplus
  • 614
  • 6
  • 14
  • Yes basically you need to know two things - the actual order is the order of declaration (including inherited interfaces esp. IUnknown) and that you can build a binary with specific call, set a break point, switch to disassembly and quick-lookup the index checking what compiler generated for specific method. – Roman R. Apr 01 '12 at 16:56