Great question! It’s smart to dig into the internals of built-in tools when working on your own DXGI capture project. Let’s break down the likely methods the Snipping Tool uses, given what you observed in WinDbg:

1. GDI Capture + D3D11 for Post-Processing #

The Snipping Tool might be using GDI-based capture APIs like BitBlt (from gdi32.dll) or PrintWindow (from user32.dll) to grab screen pixels, then leveraging D3D11 for faster post-processing (like cropping, annotating, or saving the image).

Here’s why this fits your observations:

• It calls D3D11CreateDevice to set up a hardware-accelerated context for editing the captured frame, not for the capture itself.
• It enumerates outputs via dxgi!CDXGIAdapter::EnumOutputs to map display bounds (for selecting capture regions) but doesn’t need DuplicateOutput because the actual pixel capture happens through GDI.

GDI is older but has broad compatibility, and it’s well-suited for the Snipping Tool’s core use case of capturing arbitrary screen regions.

2. Deprecated DXGI GetDisplaySurfaceData API #

Before Windows 8 introduced the Desktop Duplication API (DuplicateOutput), DXGI had IDXGIOutput::GetDisplaySurfaceData to capture the output’s frame buffer. While this API is marked as deprecated, it still works in Windows 10 for backward compatibility.

If the Snipping Tool uses this path:

• It creates a D3D11 device, enumerates outputs (matching your WinDbg observations), then calls GetDisplaySurfaceData to copy the output surface into a private texture.
• This avoids DuplicateOutput entirely, since it’s using an older DXGI capture mechanism.

3. Wrapped Modern Capture APIs #

Later versions of the Windows 10 Snipping Tool might use the Windows.Graphics.Capture API (a modern, UWP-based capture interface that works with desktop apps too). This API is built on DXGI under the hood, but its encapsulation means you won’t see direct calls to DuplicateOutput in the Snipping Tool’s process.

In this scenario:

• The D3D11CreateDevice call is to create a texture that the system uses to deliver captured frames.
• The actual capture logic runs in a system-managed process, so the DuplicateOutput invocation happens outside the Snipping Tool’s address space (hence why you didn’t see it in WinDbg).

Why Not Use DuplicateOutput? #

The Snipping Tool prioritizes compatibility and simplicity over raw performance (it doesn’t need to capture high-frame-rate video like game recorders). GDI or deprecated DXGI paths work reliably across older hardware and display configurations, while the modern Windows.Graphics.Capture API offers better security (e.g., respecting window privacy settings) without exposing low-level DXGI calls directly.

内容的提问来源于stack exchange，提问作者herb