Hook enabled |
HOOKENABLED |
If this flag is not set, DxWnd ignores the task - see gray icon |
Show hints |
SHOWHINTS |
This option activates message boxes that contain information about what DxWnd finds in a program's executable. It can't tell you exactly how to configure that program's hook, but can be helpful in determining which settings you may need to adjust. |
Additional modules: |
DxWnd's hooking logic may not notice some DLLs. In these fortunately rare cases, you can fix the issue by entering one or more module names to be added to DxWnd's search algorithm. |
SetWindowsHook |
A SetWindowsHook callback handles the injection by intercepting the creation of the first program window. It is the default DxWnd hooking schema, allowing the program to run independently from the DxWnd interface. The drawback is that the window may only be created after some operation that needed to be fixed and DxWnd will be unable to completely intercept the program's execution, resulting in some odd behaviors from the program. |
|
Debugger mode |
STARTDEBUG |
This basic hook technique intercepts the first window creation event. By this point, the program may have taken unwanted actions already, such as changing the video mode, detecting bad conditions, or crashing. Checking this flag injects DxWnd's logic right at the beginning of task execution, allowing DxWnd to intercept all events. The drawback is that this only works when the task is activated from the DxWnd interface (indicated by a yellow icon; see The Interface). Another drawback is that the injection process closely resembles the activation of a debugger, which some games will detect and intercept, shutting down the program. |
Inject suspended process |
INJECTSUSPENDED |
This hook technique is similar to the "Debugger mode" above, but does not involve debugging, allowing greater compatibility with some programs that might block that more complex method. This settings works well on Windows XP. |
Byte |
IATBYTEALIGNED |
IAT navigation schema for IAT with no OFT indication. |
Word |
IATWORDALIGNED |
The default method. |
No scan |
NOIATSCAN |
Avoid hooking scrambled IAT - fixes games of Sierra Hoyle series. |
Skip Hint in IAT seq. scan |
SKIPIATHINT |
Fixes "The Black Mirror" hooking problems. |
Default |
By default, DxWnd does not intercept the CreateProcess call and therefore does not automatically hook the program's children. To hook the program's children, use Edit > Add (see Edit) to create a new entry in the main program list for each child process. |
|
Suppress |
SUPPRESSCHILD |
This option bypasses calls to CreateProcess. Some games play intro movies in a child process (like binplayer.exe). You can skip these movies and avoid desktop configuration changes by activating this flag. |
Extend Hook |
ENABLESONHOOK |
This option automatically hooks any created child processes with the same configuration as its parent. If the child process has a random name each time it is created (generally for the express purpose of making it harder to hook), use this option. |
Extend Injection |
INJECTSON |
This option automatically hooks any created child processes with the same configuration as its parent, including DLL injection. This means that the hook is applied as soon as the process starts. |
Hot patch (obfuscated IAT) |
HOTPATCH |
The original DxWnd used IAT patching to redirect API calls to the altered routines. This method has its advantages, but fails when not all API are reached because they are located in unconnected dlls, referenced by ordinal number or referenced by programs with obfuscated IAT. IAT obfuscation is a sophisticated but common enough technique to make hacker's life harder: for instance, the game executable of Doom III has an obfuscated IAT. Checking this flag cause DxWnd to use an alternate patching technique, that is the "hot patching" that creates a detour assembly code right at the beginning of the API implementation. Once done EVERY SINGLE CALL gets intercepted no matter from where the call is made, but it isn't always possible to apply this technique. Luckily, in the vast majority of cases, they both work. |
Hook child WindowProc |
HOOKCHILDWIN |
By default, DxWnd intercepts the WindowProc routine of the main window, and this is enough for its purposes. In some cases, though, this is not enough and this flag tells DxWnd to intercept and redirect the WindowProc routines of all child windows as well. |
Hook dialog WindowProc |
HOOKDLGWIN |
Same as abowe but for dialog windows. |
WIDE vs. ANSI |
ANSIWIDE |
DxWnd uses ANSI versions of several system calls by default. This flag tells DxWnd to use the corresponding WIDECHAR version instead. |
No Run |
HOOKNORUN |
Some applications run several executables. The only game found to run like this so far is Die Hard Trilogy. It has a frontend program that runs one choice of three different executables, each one implementing one single, unique game. In this situation, each individual game needs an individual DxWnd configuration entry, and also needs to be run by the frontend. They cannot be run directly. The "No Run" flag and the corresponding blocking icon prevent the user from trying to run the game from the DxWnd interface. |
No hook update |
HOOKNOUPDATE |
Under certain conditions, the same API or method call may have different memory addresses while the program is running. Unfortunately, there is no universal policy to handle this situation: in some cases, the program only works correctly if the function's original address is updated; in other cases, it is better to stick to the original value. By default, the original address is updated. Check this flag to keep the initial original address instead. |
Disable WindowProc hooks |
NOWINDOWHOOKS |
Avoid WindowProc hook. This way it is no longer possible to control the game window size and position, you can only set the window initial position. |
Hook all DLLs |
HOOKDLLS |
The original DxWnd behaviour was limited to search & hook calls made by the main program directly. Checking this flag cause DxWnd to recurse in all non-system DLLs address space to hook calls there. It's necessary in all cases where the graphic engine is not directly coded in the program, but it's implemented in a separated engine DLL. |
No SHIMs |
COPYNOSHIMS |
This flag is useful in those cases where the program should also be used without DxWnd control and with its original shims, so that it is not possible to clear the shims for it. Also, it should be used in cases where the user doesn't have administrator privileges and can't permanently disable the shims. Users should be aware that copying an executable on the fly could get interferences from antivirus and such programs, so the operation could temporarily or permanently fail. In that case, it is possible to retry or to manually do the operation by copying the exe file, updating the path field correspondingly and turning the "No Shims" flag off. |
Hot registry |
HOTREGISTRY |
Force hooking & logging of all registry operations (experimental). |
Hook Glide libs |
HOOKGLIDE |
Enables Glide API hooking. Not currently implemented. TIP: If you are using nGlide try also changing the DirectX Version hook to DirectX9. |
Hook WinG32 |
HOOKWING32 |
For hooking of games that use the WinG32 library. |
Hook xinput |
HOOKXINPUT |
Preliminary xinput Xbox 360 controller emulation. |