You can use different types of hooking, there are some undetected methods to hook into d3d9.dll, but you could also hook into crossfire.exe.
EndScene is the function, which puts the rendered "picture" from the BackBuffer into the FrontBuffer.
The pictures are saved into the BackBuffer first, so the picture is send to the monitor completely.
When you need Font Objects or something like that for your Hack, create them in EndScene and create them there again (of course delete the old object) when Reset gets called (Reset is a function in IDirect3DDevice9, which helps you to recreate the d3dDevice when it's lost, like when you switch to another window)