0

I am trying to modify closed source game client that works with my game server. The purpose of that is being able to add new graphical elements into the client.

I have read a lot of tutorials about dll injection and in the end theres the code I made:

// dllmain.cpp : Defines the entry point for the DLL application.
#include "stdafx.h"
#include <windows.h>

#define BASE_ADDR 0x00400000

DWORD WINAPI MyThread(LPVOID);
DWORD g_threadID;
HMODULE g_hModule;
void __stdcall CallFunction(int&, int&, int&, int&, int&, int&, int&, int&);
void __stdcall typeText(int&, const char*);


//must be at least one function to prevent crash
__declspec(dllexport) int APIENTRY Func(LPVOID lpParam)
{//empty function
    return 0;
}


//main func
BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{

    DWORD myThreadID;
    HANDLE myHandle;


    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        g_hModule = hModule;
        DisableThreadLibraryCalls(hModule);
        CreateThread(NULL, NULL, &MyThread, NULL, NULL, &g_threadID);
        break;
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}


DWORD WINAPI MyThread(LPVOID)
{
    int i1 = 1;
    int i2 = 10;
    int i3 = 10;
    int i4 = 200;
    int i5 = 200;
    int i6 = 60;
    int i7 = 0;
    int i8 = 0;


    while (true)
    {
        if (GetAsyncKeyState(VK_F3) & 1) //Set F3 as hotkey
        {
            // call GUI window (do it before login)
            CallFunction(i1, i2, i3, i4, i5, i6, i7, i8);


            //display text from char (do it after login)
            //typeText(i1, "halo halo");
        }
        else if (GetAsyncKeyState(VK_F4) & 1)
            break;
        Sleep(100);
    }
    FreeLibraryAndExitThread(g_hModule, 0);


    /* another way to call function?
    typedef void tipo(int& p1, int& p2, int& p3, int& p4, int& p5, int& p6, int& p7, int& p8);
    void(*func)(int& p1, int& p2, int& p3, int& p4, int& p5, int& p6, int& p7, int& p8);
    func = (tipo*)0x490C60;
    func(i1, i2, i3, i4, i5, i6, i7, i8);
    */

    return 0;
}

//0x004067C0, pattern = (int, char*)
void __stdcall typeText(int& type, const char* text)
{
    typedef void(__stdcall *pFunctionAddress)(int&, const char*);
    pFunctionAddress pMySecretFunction = (pFunctionAddress)(0x004067C0);
    pMySecretFunction(type, text);
}

//const DWORD DrawSkinExAddress =0x490C60;.
//typedef void TF_DRAWSKIN(int nSurface, int X, int Y, int W, int H, int SkinId, int dX, int dY);
void __stdcall CallFunction(int& p1, int& p2, int& p3, int& p4, int& p5, int& p6, int& p7, int& p8)
{
    typedef void(__stdcall *pFunctionAddress)(int&, int&, int&, int&, int&, int&, int&, int&);
    pFunctionAddress pMySecretFunction = (pFunctionAddress)(0x490C60);
    pMySecretFunction(p1,p2,p3,p4,p5,p6,p7,p8);
}

I can successfully inject it and run the client. When I try to call definied there function (Press F3 to do it), the client crashes. the runtime error shows up (picture presenting error: https://imgur.com/a/ANIq0 ) and client crashes. I think theres problem with the method I call the functions. The addresses and variables are fine I think because if I try to do it on another random addresses the client just crash normally (app not responding).

I have tried replacing stdcall with cdecl but nothing has changed.

  • 2
    Where do you get the address of function you want to call? It shouldn't be hard-code. – EWD-0- Nov 22 '17 at 12:14
-1

The address I used was wrong :|

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.