1

The program I'm messing with has builtin logging. Using a proxy DLL, I managed to activate it by calling the right functions from the real DLL. However, I got stuck at using the actual logging functions, as the program crashes with Error 0xC0000142 whenever I get close to using them.

Here's what I'm doing in my proxy DLL:

typedef void (*FDLAddr_t)(void);
FDLAddr_t ForceDebugLog;

typedef void (*LIAddr_t)(char const *, ...);
LIAddr_t LogInfo;

void setupFuncs() {
    HMODULE trueDll= GetModuleHandleA(".\\trueDll.dll");
    ForceDebugLog = (FDLAddr_t)GetProcAddress(trueDll, "?ForceDebugLog@@YAXXZ");
    // LogInfo = (LIAddr_t)GetProcAddress(trueDll, "?LogInfo@@YAXPBDZZ");
}

Now, I can just do ForceDebugLog(); and logging gets enabled. However, as soon as I uncomment the LogInfo line, the program crashes on startup with Windows showing the error 0xc0000142.

Further experimentation shows that GetProcAddress returns the address of LogInfo in the DLL. Also, the line appears to be fine if LogInfo was a FARPROC, as that works without a problem. As soon as I add the cast to LIAddr_t, the error comes back.

How can I work around this issue? Or do I need to take a different approach? All binaries involved are 32 bit.

1 Answer 1

1

As it turns out, the code above works correctly and the issue was somewhere else entirely.

While looking at my DLL in ghidra, I noticed that there were some strings defined that appeared nowhere in my code. As it turns out, some old object files from earlier experiments were accidentally linked into the DLL. One of the experiments was a reimplementation of LogInfo which caused the compiler/linker to produce an incorrect result.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.