快速调用函数崩溃

问题描述：

试图从我的程序中使用fastcall约定来调用进程函数，但每次尝试时都会崩溃。过去了就这么多时间和不能解决......需要一些帮助，请... 这里的所有需要的信息，并尝试我：快速调用函数崩溃

图为断点后的指令上下文该函数的程序运行时...

这是我的代码源：提前:)

typedef void (__fastcall * MyFoo)(void * client,DWORD trash, DWORD ConstantD, DWORD objBattid, DWORD zeroParam, DWORD thousParam, float fVal,DWORD targetID); 
MyFoo launchMe; 

DWORD getProcessBaseAdress(DWORD ProcessID); 

char *flyffServer = "insanity flyff\0"; 

HWND neuzWindow = NULL; 
DWORD neuzProcessID = NULL; 
DWORD neuzRamAdress = NULL; 
HANDLE neuzHandle = NULL; 
DWORD clientAdr = NULL; 

int main(){ 
neuzWindow = FindWindowA(0,flyffServer); 
//-------------------------------------- 
if(neuzWindow){ 
    GetWindowThreadProcessId(neuzWindow,&neuzProcessID); 

    if(neuzProcessID){ 
     neuzHandle = OpenProcess(PROCESS_ALL_ACCESS,false,neuzProcessID); 

     if(neuzHandle){ 
      neuzRamAdress = getProcessBaseAdress(neuzProcessID); // Extracting Neuz's base address 

      if(neuzRamAdress){ 
       launchMe = (MyFoo)((DWORD)neuzRamAdress + 0x5C400); 
       clientAdr = (DWORD)neuzRamAdress + 0x8D0DC0; 

       printf("Instruction: 0x%08X\n",launchMe); 
       printf("Client ADR: 0x%08X\n",clientAdr); 

       for(;;Sleep(100)){ 
        //------------ init params ------------ 
        void * client = (void*)clientAdr; 
        DWORD trashDX = (DWORD)0x0000000B; 
        DWORD msge = (DWORD)0x0000001D; 
        DWORD selectedBattID = 0x04D4A929; 
        DWORD zeroParam = (DWORD) 0x00000000; 
        DWORD milleParam = 0x00010000; 
        float speedAtt = 0.07f; 
        DWORD targetID = 0x0089B964; 

        printf("0x%08X\n0x%08X\n0x%08X\n0x%08X\n0x%08X\n0x%08X\n%f\n0x%08X\n", 
         client, 
         trashDX, 
         msge, 
         selectedBattID, 
         zeroParam, 
         thousParam, 
         speedAtt, 
         targetID 
        ); 

         launchMe(client,trashDX,msge,selectedBattID,zeroParam,milleParam,speedAtt,targetID); // -> Error 
         scanf("%d",&trashDX); // for blocking the program 
         return 0; 
       } 
      } 
      else printf("Unable to access to Neuz's Ram Adress\n"); 
     } 
     else printf("Unable to obtain neuz's handle\n"); 
    } 
    else printf("Unable to detect neuz's process ID\n"); 
} 
else printf("Unable to detect neuz's window\n"); 
return 0; 
} 

DWORD getProcessBaseAdress(DWORD ProcessID){ 
    HANDLE hModuleSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, ProcessID); 
    MODULEENTRY32 me32; 
    me32.dwSize = sizeof(MODULEENTRY32); 
    Module32First(hModuleSnap,&me32); 
    return (DWORD) me32.modBaseAddr; 
}

谢谢...

这个问题不能回答，给出的信息（我没有点击图像链接到一个随机图像托管网站）。我们无法知道，偏移量为0x5C400的函数需要什么调用约定，但是如果导致*“崩溃”*，那么它就不是您指定的那个。 – IInspectable

如果你查看图片，你会看到一张图片，上面有cheatengine的debbugging过程，以获得带有完整堆栈元素的指令地址来检查参数，并且我的地址/参数与debbuger中显示的值相同。。我应该提供哪些东西以便能回答我？ – Mouley

偏移量为0x5C400的函数的** true **签名。到目前为止，我们只看到你最好的猜测。 – IInspectable

答

正如在他的评论中可以看到的那样，问题来自访问另一个进程的虚拟空间。检查Windows内存管理和DLL注入将为我解决这个问题......也许任何人都会面对未来。

快速调用函数崩溃

相关推荐