0

I am currently playing with C# and detours/trampolines using a library I found here: https://github.com/xcvd/Detours

I am attempting to hook a known function in a game and then call the original function. I am able to successfully hook the function but any attempt to call the original function errors with:

Exception thrown at 0x00E6EEEE in game.exe: 0xC0000005: Access violation writing location 0x0001762C.

This is my setup of the detours

public DetoursManager()
{
    ChatHookDelegate vHookDelegate = ChatHook;
    IntPtr sourceFunction = MemoryService.GetOffsetValue(Process.GetCurrentProcess(), Offsets.HOOK_DSP_CHAT);
    fHookManager.Add("ChatHook", new Hook(sourceFunction, vHookDelegate, vHookDelegate.GetType()));

    CommandHookDelegate vCommandHookDelegate = CommandHook;
    sourceFunction = MemoryService.GetOffsetValue(Process.GetCurrentProcess(), Offsets.HOOK_COMMANDS);
    fHookManager.Add("CommandHook", new Hook(sourceFunction, vCommandHookDelegate, vCommandHookDelegate.GetType()));

    Debug.WriteLine("Installing all Hooks");
    fHookManager.InstallAll();
    Debug.WriteLine("Finished installing all Hooks");
}

Below is my delegate function that I hook (my destination function)

public void CommandHook(IntPtr pChar, string pCommand)
{
    try
    {
        fHookManager["CommandHook"].CallOriginal(new object[] { pChar, pCommand });
    }
    catch (Exception vException)
    {
        Debug.WriteLine("CommandHookException: " + vException.Message);
    }
}

I'm almost 100% certain that the IntPtr pChar pointer I am passing in is accurate as it is a known pointer for something else and matches what I see in memory. Additionally, the hook is passed the pointer to begin with and I don't change it.

It's also worth mentioning that I know that at least SOME of the original function is being called because I get output that indicates as such, however, I am just not sure what within the original function is causing the crash/exception and I'm not entirely sure how else to debug this given I do not have the source or pdb for the game.exe I am playing with.

Any tips or suggestions would be appreciated.

1
  • Found some additional details which is that the C/C++ unmanaged code I am calling using the calling convention ThisCall. I was able to add the attribute to my delegate [UnmanagedFunctionPointer(CallingConvention.ThisCall)] which has stopped the crashing but the results are wrong (the game does something it's not supposed to). Now the incoming string pCommand on my hook has gibberish text instead of the actual command (that used to come across correctly before ThisCall) – user3645197 Mar 9 at 3:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.