I have been toiling more with the XNA libs, trying to get the IDirect3DDevice9Ex injected in...And boy, its not easy! Specially since there is so much unmanaged code in the XNA libs and the unmanaged code it's calling isn't so obvious via Reflector.
I started off with the ILDASM tool to find the byte patterns of the IL I wanted to change. Then with my trusty hex editor, I searched for the bytes and replaced them.
So far I have been replacing the hard-coded D3DPOOL_MANAGED to D3DPOOL_DEFAULT where applicable. This involves changing the IL command "ldc.i4.1" (byte value 0x17) with the IL command "ldc.i4.0" (byte value 0x16). Though I have to be careful because the XNA content manager seems to also use the D3DPOOL_SYSTEMMEM. For some reason using the content manager seems to make it crash right now, but if I don't use it, things seem to be fine so far! The screenshot (though not perfect yet) is XNA running a 9Ex device!
I think if I can get the content manager to work, I should be a step closer.