VTable is located at the instance pointer of d3d device. Usually in the eax register. Look for calls to Direct3DCreate9 to get the IDirect3D9 instance pointer. The CreateDevice method is called through the IDirect3D9 pointer which is just an offset to a function pointer table. From there, you should be able to trace the CreateDevice call, grab device. Then the present, beginscene and endscene methods are stored in the vtable to which the offsets are public and could be found anywhere with a bit of searching. There is another way to get the device pointer, and that's by creating your own device which will end up pointing to an already existing device to make your job easier.