Trying to hook D3D EndScene

Question

So I've been playing around with C++ and injecting DLLs, fairly new to this but learning fairly quickly. I'm trying to hook EndScene and just cannot get it working. I've tried using a pattern scan to find and then hook it, I've tried creating a dummy d3d device and finding the EndScene through its VTable. Each time it fails i get an Access Violation so I can only assume I have the wrong address for the function or maybe I'm missing something completely. I have tried a lot of different ways but due to limited knowledge need a little more help.

DWORD dEndScene = 0x10066D50;
HMODULE hBaseAddress = GetModuleHandle("d3d9.dll");

BYTE* pEndFunction = (BYTE*)reinterpret_cast<uintptr_t>(hBaseAddress);
pEndFunction = pEndFunction + dEndScene;

fEndScene = (oEndScene)DetourFunction(pEndFunction, (PBYTE)EndScene);

Answer 1

The vtable is likely write protected. You can use VirtualProtect.

And some slightly different approaches:

Is it possible to replace Direct3DCreate9(Ex) before its created? Then you just make proxy objects for the interfaces you want, which can then just delegate normally, do stuff before/after, or do something different entirely.

Or if you can get the IDirect3DDevice9 instance pointer, by getting then editing the vtable it references (again VirtualProtect, but avoids needing to know where the function lives in advance, which might change in various cases).