How to access the raw memory of d3d model in game maker?

There is not a built-in function for this. In GameMaker: Studio and newer, you would probably use buffer_get_address and pass the updated buffer to vertex_buffer_create_from_buffer, but in GM8.x (which the question author uses) that was not yet a thing.

What follows requires a degree of determination.

First you would want to find out an address of a built-in d3d_model_* function. I'll use d3d_model_clear here since it's one of the more straightforward ones.

• In GM8.1 you would want to use function_get_address.
• In GM:S you would want to use this trick I came up with.

Despite the amount of rewriting behind the scenes, the function stayed quite alike:

• First it CALLs (opcode E8) a function to pull out an integer out of the only argument.

• Then it CALLs (E8 again) the implementation.

• The implementation goes like this:

  void internal_d3d_model_clear(int index) { if (index >= 0 && index < internal_d3d_model_count) { // internal_d3d_model_array is an internal_d3d_model* internal_d3d_model* a_model = internal_d3d_model_array[index]; } } 

  which in assembly means

  TEST index, index <JS or JL> ... CMP index, internal_d3d_model_count JGE ... MOV a_model, internal_d3d_model_array // +index*4 here or in next instruction 

With the function address in your hands you could either:

• Simply connect Visual Studio debugger to the game (Debug > Attach to Process), look at disassembly, and copy the fixed location of internal_d3d_model_array from the MOV instruction. This will not work when changing GM versions
• Use an instruction parser (like this one) to have it dynamically extract the location of internal_d3d_model_array from the inner function.

Once you have that location, you can dereference the array pointer from it (your_d3d_model_struct* d3d_model_array = (your_d3d_model_struct*)(*(int*)that_address)) and start investigating what is stored inside each model using the memory viewer or Watches window in Visual Studio - considering the circumstances, I would guess that there is another pointer to either raw vertex buffer data or an array of structs representing diffferent primitive operations.