Skyrim post process injector full#
Skyrim post process injector code#

typedef HRESULT ( _stdcall * fn_D3D11CreateDeviceAndSwapChain )( IDXGIAdapter *, D3D_DRIVER_TYPE, HMODULE, UINT, const D3D_FEATURE_LEVEL *, UINT, UINT, const DXGI_SWAP_CHAIN_DESC *, IDXGISwapChain **, ID3D11Device **, D3D_FEATURE_LEVEL *, ID3D11DeviceContext ** ) fn_D3D11CreateDeviceAndSwapChain LoadD3D11AndGetOriginalFuncPointer () Actually Drawing a Triangle def file already declared that the proxy dll was exporting a function called D3D11CreateDeviceAndSwapChain, so all I had to do was create that function with the right type signature, and in the function body, load the real D3D11 library and call the real D3D11CreateDeviceAndSwapChain function. This is a relatively straightforward process. The goal here being that I could get Skyrim to load my dll (confirmed by a call to MessageBox in DLLMain), and run like normal. My next step was to try to write a proxy dll that didnвЂ™t do anything except forward all calls to D3D11CreateDeviceAndSwapChain to the real version of that function, and return the result. I changed my system's language to french once, some things have never changed back

This isnвЂ™t a new idea by any means, thereвЂ™s tons of projects and literature out there for using proxy dlls for everything (including game hacking). DLLs that do this are called вЂњproxyвЂќ dlls. In cases where I wanted to add my own logic, I could intercept any function call I wanted and insert that logic before or after calling the real D3D11.dllвЂ™s function.

Skyrim post process injector code#

For functions I didnвЂ™t want to add any additional sauce to, my code would call the real dllвЂ™s version of that function and return the result. This dll would sit in between the game code and the real version of d3d11.dll. My plan was to create my own dll, call it d3d11.dll, and place it in the same directory as SkyrimвЂ™s executable. I knew that Skyrim uses DirectX 11 for itвЂ™s renderer, which means that it loads d3d11.dll during startup. Whenever a program loads a DLL by name, it looks in a number of pre-set locations for that DLL, and loads the first one it finds.

Skyrim post process injector full#

Instead of injecting a dll containing the code to draw a triangle, I decided to abuse WindowsвЂ™ DLL search order to get Skyrim to load a dll full of my code during startup. IвЂ™ve built a few projects that have used process injection to get programs to run code they didnвЂ™t intend to, so for this project I decided to try something new. Note: you're looking for modern c++, clean code or best practices, turn back nowДЄs usual with things I write about, all the code for this project is up on github, so if you just want to see the code, have at it! DLL Hijacking is the New DLL Injection