So, I'm working with a process which loads d3dx9.dll at runtime, and I believe it also captures keystrokes through DirectInput. So, my questions are:
How do I determine whether it is actually using DirectInput to capture keystrokes?
What is the callback which fires to send those keystrokes to the process?
I have read some tutorials and code for this sort of thing, and I have loaded the process into both OllyDbg and IDA Pro. I can see it loading d3dx9.dll, but not dinput.dll. The source suggests that DirectInput8Create is the callback for mouse/keyboard input. I dumped the first 256 bytes of DirectInput8Create loaded in my own application from LoadLibrary/GetProcAddress, and I cannot find a byte match in the process at runtime. Perhaps I am going about it wrong. Even if I do find it, I still then have to figure out how to map that address back to an entry in the IAT. Is this process even correct, or am I going about this completely wrong?







