You can only read / write texture / vertex data in dx7 after a lock so extended results from lockbuffer and maybe a new lockvertexbuffer command may be what you are after.
In regards to hacking, I would imagine the logic would be simple enough to follow if you stepped into a lockbuffer call with any decent debugger hook up (which I imagine you will require for all that volumetric c code you have planned).
hint: if you are in visual studio build your dll in debug mode, put a breakpoint in a function called by your blitz app, when you hit F5 it will ask you for an exe to run, select your blitz app, ignore the missing debug warning and you be sussed, when you step out of the function you have breakpointed, you will be stepping through your blitzapp in good ol x86 assembler
In regards to hacking, I would imagine the logic would be simple enough to follow if you stepped into a lockbuffer call with any decent debugger hook up (which I imagine you will require for all that volumetric c code you have planned).
hint: if you are in visual studio build your dll in debug mode, put a breakpoint in a function called by your blitz app, when you hit F5 it will ask you for an exe to run, select your blitz app, ignore the missing debug warning and you be sussed, when you step out of the function you have breakpointed, you will be stepping through your blitzapp in good ol x86 assembler