How does programs like Fraps or Dxtory get FPS?

[Engelard]

I know that for example Fraps attach FRAPS.dll to other process, and then, as i understand, it's using game itself to draw the numbers just inside the game. But how Fraps know to which process need attach it's DLL? I mean, some time ago i've made simple OpenGL exercise which was only drawing couple of polygons, and FRAPS automatically detect my app and start showing FPS inside my just created app. So i can't understand next things:

1. How does such programs can draw inside other apps?
2. How it define that target program have frames at the first place, and which apps does'nt, so it start working only with proper apps.
3. Where FPS variable of app is stored and how such programs find it so quickly, or it's scaling somehow FPS by itself?

Pls clarify me.

[ben.cottrell]

@Engelard this involves Windows API functions which find the window from the cursor point, possibly with WindowFromPoint which returns an HWND. From that HWND you can resolve the parent process with GetProcessHandleFromHwnd .

At the core of Windows applications is the message loop within which it calls a callback function, or window procedure, to handle event messages. There's a function called SetWinEventHook which allows intercepting certain window messages in a given range.

Now, if fraps can get the HWND of your app it can either intercept the WM_PAINT message to get a device context to draw over the top of the content, or it could create a child window displaying the FPS. But those are guesses.

Other than what I've speculated on, if you want to find out what's actually happening, you could use OllyDbg to reverse engineer the program.