I am trying to retrieve text from another program. I used Ollydbg to find the address for the function I need to hook to get the info. I used EasyHook to inject the code below.

The hook works fine until I call the original function. It crashes each time I do. I think it may have something to do with the return type of the function. Since I am new to reversing, I am having trouble determining the correct return type. I tried several different return types ranging from void to int. After the function returns, EAX points to a unicode string but the value isn't used. From what I read, EAX is where a returned variable would be stored.

I now see that this exception is occurring.

System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
   at ServerDLL.Injector.DoSomeThingDelegate.Invoke(Int32 argument1, Int32 argument2)
   at ServerDLL.Injector.DoSomeThing(Int32 argument1, Int32 argument2)

Calling the function:

Address   Hex dump          Command                                  Comments
00425373  |.  894424 04     MOV DWORD PTR SS:[ESP+4],EAX             ; /Arg2
00425377  |.  8B45 A8       MOV EAX,DWORD PTR SS:[EBP-58]            ; |
0042537A  |.  890424        MOV DWORD PTR SS:[ESP],EAX               ; |Arg1
0042537D  |.  E8 8EC3FFFF   CALL DoSomething;
00425382  |.  8B4D 8C       MOV ECX,DWORD PTR SS:[EBP-74]
00425385  |.  8B45 A8       MOV EAX,DWORD PTR SS:[EBP-58]


static string DoSomeThing(int argument1, int argument2)
    DoSomeThingDelegate del = Marshal.GetDelegateForFunctionPointer(new IntPtr(0x421810), typeof(DoSomeThingDelegate)) as DoSomeThingDelegate;
    if (del == null) return "";
    return del(seatnumber, stack); 

[UnmanagedFunctionPointer(CallingConvention.Cdecl, SetLastError = true, CharSet = CharSet.Auto)]
delegate string DoSomeThingDelegate(int argument1, int argument2);

public void Run(RemoteHooking.IContext InContext, String InArg1)
    CreateRecvHook = LocalHook.Create(new IntPtr(0x421810), new  DoSomeThingDelegate(DoSomeThing), this);
    CreateRecvHook.ThreadACL.SetExclusiveACL(new Int32[] { 0 });
  • The error may be caused due to the improper calling convention (cdecl, stdcall, fastcall etc) rather than the return type. From the code dump, it looks more of a stdcall as the stack pointer is not adjusted. – 0xec May 4 '15 at 9:08
  • It seems EasyHook must use cdecl, stdcall, or thiscall. It still crashed with the same exception after changing to the other calling conventions though. – Player5 May 4 '15 at 9:52
  • 1
    I don't understand, you say you want to hook another program, but then you're creating a process-local hook? After skimming the docs, I think you need RemoteHooking. – svick May 4 '15 at 10:46
  • That code is in the DLL that I am injecting. It is how all the examples I have seen are done. I use RemoteHooking.Inject to inject it though. Also, it gets injected fine. I can retrieve the values I need. The problem is with calling the original function. When it is called, I get the exception. – Player5 May 4 '15 at 20:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.