我正在开发一个 DLL,目的是将它注入到游戏的运行进程中。我已经找到了一些关键函数的内存地址(通过 Immunity Debugger),我试图从我注入的 DLL 中调用这些函数。
到目前为止,每当我注入我的 DLL 并按下 ALT+T 的热键组合时,游戏客户端就会停止响应并崩溃。在一个特定的实例中,它显示了一个调试错误,说:“由于 ESP 值已更改,进程无法恢复执行”或类似内容。
我是否必须在从 DLL 内部调用进程函数之前和之后更改 ESP 值?如果是这样,我将如何正确执行此操作。
这是我的 DLL 的源代码:
// Warband_Chat.cpp : Defines the exported functions for the DLL application.
#include "stdafx.h"
#include <windows.h> // Include the functions we are going to use like Sleep and hInstance etc...
#include <fstream> // Allows us to work with files on the hard drive.
#include <iostream>
#define MAX_BUFFER_SIZE 300 // Maximum chat message size: 300 characters.
#define ThreadMake(x) CreateThread(NULL,NULL,(LPTHREAD_START_ROUTINE)&x,NULL,NULL,NULL); // Makes creating threads easy, it just requires 1 parameter(the function).
using namespace std;
// Define process(Warband) function based on its parameters and its location in memory.
typedef void(__cdecl* ChatFunc)(char*);
ChatFunc Chat = (ChatFunc)0x00450C60;
wchar_t *convertCharArrayToLPCWSTR(const char* charArray)
/* Converts a char array to a LCPWSTR string. */
{
wchar_t* wString=new wchar_t[4096];
MultiByteToWideChar(CP_ACP, 0, charArray, -1, wString, 4096);
return wString;
}
int getkey(char x) // A function I made to get 1 key and automatically check ALT(vk_menu,0x12)
{
if(GetAsyncKeyState(VK_MENU)&0x8000 && GetAsyncKeyState(x)&0x8000)//Check if we are pressing ALT and what ever is inside x
{
return 1; // if we are then return true.
}
return 0; // If the condition is not met then return false
}
void main() // the main function
{
while(1) // the main loop
{
if(getkey('T')) // If we are pressing ALT + T then do
{
ifstream file("chat.txt");
if (!file.is_open())
{
MessageBox(NULL, L"Failed to open chat.txt. Make sure its on your root Mount & Blade: Warband folder.", L"Failed", MB_OK);
}
else
{
char buffer[MAX_BUFFER_SIZE];
file.getline(buffer, MAX_BUFFER_SIZE-1);
Chat(buffer); // Call chat function
LPCWSTR newbuffer = convertCharArrayToLPCWSTR(buffer);
MessageBox(NULL, newbuffer, L"Success", MB_OK); // Post a message if we injected.
// the L before the messages is just to tell MSVS that those are LPCTSTR characters.
}
file.close();
Sleep(20); // Sleep so we don't lag
}
Sleep(20); // no lag.
}
}
extern "C" // DLL Hook
{
__declspec(dllexport) BOOL __stdcall DllMain(HINSTANCE hInst,DWORD reason,LPVOID lpv)
{
if (reason == DLL_PROCESS_ATTACH)
{
DisableThreadLibraryCalls(hInst);
ThreadMake(main); // Creates a new thread on the process.
}
return true;
}
}