I've been attempting to build my own implementation of Nvidia's Surround functionality by using their DLLs within a more reliable and automatic system. I'm pretty new to this; I've been a programmer for a while, but I've never had need to do any reverse engineering like this, so apologies if I'm being profoundly dumb.
So far I have managed the following:
- Found the names and addresses of the exported functions that relate to what I want to do inside NVCPL.dll.
- Found the only exe that seems to load in a copy of that DLL (nvcplui.exe).
- Using API monitor, I found an instance of one of the DLL's functions being called at what seems to be the right time.
- Put break points in the assembly of nvcpl.dll whilst attached to nvcplui.exe via x64_dbg
Where I'm stuck:
When I was using API monitor, I couldn't seem to catch any direct calls to the function I was looking at (NvCplApiDisableSpan), I only ever found it in the stack before a wndproc call. Also, the break points that I placed in and around that function never get triggered.
My current thoughts are that I'll need to "see" the assembly of the function being called so I can get to the next step of figuring out how to shape my calls to that function correctly.
I thought perhaps that the function was being called by a different process, having being triggered to do so by nvcplui.exe, but according to procexp that's not the case; nvcplui.exe is the only process using that dll.
Any advise you have for me would be greatly appreciated; I'm not averse to doing my homework, but I can't see a way forward without maybe getting hold of a copy of IDA, however, that's a little outside my budget.