1

I am developing a DLL for the purpose of injecting it into a running process for a game. I've found the memory addresses to some key functions(via Immunity Debugger) and I am trying to call those functions from within' my injected DLL.

So far whenever I inject my DLL and press the hotkey combination of ALT+T, the game client stops responding and crashes. At one particular instance it showed a debug error saying: "The process was not able to resume execution because the ESP value was changed", or something similar.

Do I have to alter the ESP value before and after I call the process function from within' my DLL? If so, how would I do this properly.

Here is the source code of my DLL:

// Warband_Chat.cpp : Defines the exported functions for the DLL application.

#include "stdafx.h"
#include <windows.h> // Include the functions we are going to use like Sleep and hInstance etc...
#include <fstream> // Allows us to work with files on the hard drive.
#include <iostream>

#define MAX_BUFFER_SIZE 300 // Maximum chat message size: 300 characters.
#define ThreadMake(x) CreateThread(NULL,NULL,(LPTHREAD_START_ROUTINE)&x,NULL,NULL,NULL); // Makes creating threads easy, it just requires 1 parameter(the function).
using namespace std;

// Define process(Warband) function based on its parameters and its location in memory.
typedef void(__cdecl* ChatFunc)(char*);
ChatFunc Chat = (ChatFunc)0x00450C60;


wchar_t *convertCharArrayToLPCWSTR(const char* charArray)
/* Converts a char array to a LCPWSTR string. */
{
    wchar_t* wString=new wchar_t[4096];
    MultiByteToWideChar(CP_ACP, 0, charArray, -1, wString, 4096);
    return wString;
}


int getkey(char x) // A function I made to get 1 key and automatically check ALT(vk_menu,0x12)
{
    if(GetAsyncKeyState(VK_MENU)&0x8000 && GetAsyncKeyState(x)&0x8000)//Check if we are pressing ALT and what ever is inside x
    {
        return 1; // if we are then return true.
    }
    return 0; // If the condition is not met then return false
}


void main() // the main function
{
    while(1) // the main loop
    {
        if(getkey('T')) // If we are pressing ALT + T then do
        {
                        ifstream file("chat.txt");
                        if (!file.is_open())
                        {
                                MessageBox(NULL, L"Failed to open chat.txt. Make sure its on your root Mount & Blade: Warband folder.", L"Failed", MB_OK);
                        }
                        else
                        {
                                char buffer[MAX_BUFFER_SIZE];
                                file.getline(buffer, MAX_BUFFER_SIZE-1);
                                Chat(buffer); // Call chat function
                                LPCWSTR newbuffer = convertCharArrayToLPCWSTR(buffer);
                                MessageBox(NULL, newbuffer, L"Success", MB_OK); // Post a message if we injected.
                                // the L before the messages is just to tell MSVS that those are LPCTSTR characters.
                        }
                        file.close();
            Sleep(20); // Sleep so we don't lag
        }
                Sleep(20); // no lag.
    }
}


extern "C" // DLL Hook
{
    __declspec(dllexport) BOOL __stdcall DllMain(HINSTANCE hInst,DWORD reason,LPVOID lpv)
    {
        if (reason == DLL_PROCESS_ATTACH)
        {
            DisableThreadLibraryCalls(hInst);
            ThreadMake(main); // Creates a new thread on the process.
        }
    return true;
    }
}
  • Have you made sure the function you're calling is not subject to ASLR? – Guntram Blohm supports Monica Dec 20 '14 at 23:36
  • Not the problem you want to hear about, but your main function should be LRESULT instead of void and should have return statement. – ST3 Dec 22 '14 at 9:23
2

At one particular instance it showed a debug error saying: "The process was not able to resume execution because the ESP value was changed", or something similar.

...

typedef void(__cdecl* ChatFunc)(char*);
ChatFunc Chat = (ChatFunc)0x00450C60;

It sounds like the function at 0x00450C60 is not a __cdecl function and/or it doesn't take exactly one function argument. Re-analyze the disassembly of that function and fix your prototype.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.