> Technique · Delphi DXGI / WGC Screen Capture Technique_

~/packetpursuit $ cat /intel/techniques/delphi-screen-capture-dxgi-wgc.md

typetechniqueconfidencehighcreated2026-08-07updated2026-08-07delphiscreen-capturedxgiwgcanti-vmdetection

delphi-screen-capture-dxgi-wgc

Detection fingerprint and defensive notes for Delphi/Embarcadero binaries that embed dual-engine screen capture via DXGI Desktop Duplication API and Windows Graphics Capture (WGC).

What It Does

This technique provides real-time, low-overhead screen capture by:

  1. Probing OS capability (TOSCaps with HasDXGI, HasExcludeFromCapture, HasWGC).
  2. Using DXGI Desktop Duplication API (uCaptureDXGI) to capture delta rectangles (only changed regions) and encode them as JPEG (DirtyJpegs).
  3. Falling back to Windows Graphics Capture (uCaptureWGC) on newer Windows builds.
  4. Falling back further to GDI BitBlt/GetDIBits if both modern APIs are unavailable.

Detection / Fingerprint

Look for these string clusters in a Delphi PE32:

  • uCaptureDXGI
  • uCaptureWGC
  • TDXGIDeltaResult
  • DirtyRects
  • DirtyJpegs
  • MoveRects
  • ScreenW / ScreenH
  • TOSCaps with HasDXGI / HasWGC / HasExcludeFromCapture

Import-wise, the binary will reference gdi32.dll BitBlt, StretchBlt, GetDIBits, CreateCompatibleDC, CreateCompatibleBitmap even when using DXGI/WGC, because GDI is the ultimate fallback.

Implementation Patterns

In the bromechokucom sample, the capture stack is custom-written (not a standard Delphi component). It exposes:

  • Delta-result objects (TDXGIDeltaResult) with HasData flag
  • JPEG-encoded dirty rectangles
  • Move rectangles for cursor/window motion

This suggests the attacker intends to stream screen deltas to a C2 operator in real time, not merely take periodic screenshots.

Defensive Countermeasures

  • API hooking / EDR telemetry: Monitor D3D11CreateDevice + IDXGIOutputDuplication::AcquireNextFrame calls.
  • Process monitoring: Unexpected BitBlt/GetDIBits spikes from a non-presentation process.
  • Display affinity: The sample delay-imports SetWindowDisplayAffinity, which can be used to mark windows as non-capturable; defenders can invert this by ensuring sensitive banking apps set WDA_EXCLUDEFROMCAPTURE.
  • Network detection: Real-time delta streams produce sustained outbound JPEG-like traffic (high entropy, variable size, bursty).

Reproduce on Your Own VMs

To build a comparable capture stack in Delphi:

  1. Create a new VCL Forms application in RAD Studio.
  2. Import Winapi.DXGI and Winapi.D3D11 units.
  3. Use D3D11CreateDevice to obtain an IDXGIDevice, then IDXGIOutput::QueryInterface for IDXGIOutput1.
  4. Call IDXGIOutput1::DuplicateOutput to get IDXGIOutputDuplication.
  5. Loop AcquireNextFrame → GetFrameDirtyRects → JPEG-encode via TJPEGEncoder.
  6. On failure, fall back to GetDC(0) → BitBlt → GetDIBits.

Verification: strings in the resulting EXE will contain IDXGIOutputDuplication, AcquireNextFrame, and DirtyRects.

Pages Where Observed