| View previous topic :: View next topic |
| Author |
Message |
Diedy
Newbie cheater
![]() Reputation: 0
Joined: 15 Jun 2011
Posts: 10
|
 Posted: Fri Jun 24, 2011 4:42 am Post subject: Assembly injection to simple C++ program fails. |
 |
|
I have a C++ program that is VERY basic:
| Code: |
#include "stdafx.h"
#include <iostream>
#include <string>
using namespace std;
using std::endl;
using std::string;
static void printABC123()
{
std::cout << "I was printed" << endl;
}
int _tmain(int argc, _TCHAR* argv[])
{
printABC123();
while(true)
{
}
return 0;
}
|
Now I want to inject a call to the printABC123 function from C#:
| Code: |
static void Main(string[] args)
{
BlackMagic BM = new BlackMagic();
if (BM.OpenProcessAndThread(SProcess.GetProcessFromProcessName("InjectC++")))
{
DateTime dt = DateTime.Now;
try
{
uint ptr = BM.AllocateMemory(128);
BM.Asm.Clear();
BM.Asm.AddLine("call " + 0x00411510);
BM.Asm.AddLine("retn");
BM.Asm.InjectAndExecute(ptr);
}
catch (Exception e)
{
Console.WriteLine("Injection failed: " + e.Source + " : " + e.Message + " : " + e.InnerException);
}
}
else
{
Console.WriteLine("LoL could not be opened for read/write.");
}
Console.ReadLine();
}
|
When I run both programs (C++ 1st then C#)
I get the following error in my C++ application:
| Quote: |
Unhandled exception at 0x00411510 in InjectC++.exe: 0xC0000005: Access violation.
|
I have no idea what and why.
This is the assembly code of the function I try to call:
| Code: |
00411510
.text:00411510 ; =============== S U B R O U T I N E =======================================
.text:00411510
.text:00411510 ; Attributes: bp-based frame
.text:00411510
.text:00411510 printABC123 proc near ; CODE XREF: wmain+1Ep
.text:00411510
.text:00411510 var_C0 = byte ptr -0C0h
.text:00411510
.text:00411510 push ebp
.text:00411511 mov ebp, esp
.text:00411513 sub esp, 0C0h
.text:00411519 push ebx
.text:0041151A push esi
.text:0041151B push edi
.text:0041151C lea edi, [ebp+var_C0]
.text:00411522 mov ecx, 30h
.text:00411527 mov eax, 0CCCCCCCCh
.text:0041152C rep stosd
.text:0041152E mov esi, esp
.text:00411530 mov eax, ds:__imp_?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z ; std::endl(std::basic_ostream<char,std::char_traits<char>> &)
.text:00411535 push eax
.text:00411536 push offset aIWasPrinted ; "I was printed"
.text:0041153B mov ecx, ds:__imp_?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ; std::basic_ostream<char,std::char_traits<char>> std::cout
.text:00411541 push ecx
.text:00411542 call j_std__operator___std__char_traits_char___
.text:00411547 add esp, 8
.text:0041154A mov ecx, eax
.text:0041154C call ds:__imp_??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ; std::basic_ostream<char,std::char_traits<char>>::operator<<(std::basic_ostream<char,std::char_traits<char>> & (*)(std::basic_ostream<char,std::char_traits<char>> &))
.text:00411552 cmp esi, esp
.text:00411554 call j__RTC_CheckEsp
.text:00411559 pop edi
.text:0041155A pop esi
.text:0041155B pop ebx
.text:0041155C add esp, 0C0h
.text:00411562 cmp ebp, esp
.text:00411564 call j__RTC_CheckEsp
.text:00411569 mov esp, ebp
.text:0041156B pop ebp
.text:0041156C retn
.text:0041156C printABC123 endp
|
Does anyone know what is wrong?
This is a very basic environment and it still ain't working for me 
Thanks in advance !
Diede
|
|
| Back to top |
|
 |
Dark Byte
Site Admin
 Reputation: 474
Joined: 09 May 2003
Posts: 25962
Location: The netherlands
|
| Posted: Fri Jun 24, 2011 7:55 am Post subject: |
|
|
And you are sure that you haven't recompiled InjectC++.exe causing the address to shift ?
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
Diedy
Newbie cheater
![]() Reputation: 0
Joined: 15 Jun 2011
Posts: 10
|
| Posted: Fri Jun 24, 2011 8:37 am Post subject: |
|
|
| Dark Byte wrote: | | And you are sure that you haven't recompiled InjectC++.exe causing the address to shift ? |
I just recompiled it, opened it up in IDA to check the new one if the address would be different, it wasn't I pressed F5 and opened to process in CE, went to the same address and it said ?? at OP code 
Do you have any other idea ?
Thanks already !!
Diede
|
|
| Back to top |
|
|
Dark Byte
Site Admin
Reputation: 474
Joined: 09 May 2003
Posts: 25962
Location: The netherlands
|
| Posted: Fri Jun 24, 2011 6:46 pm Post subject: |
|
|
use module32first/module32next to find the base address of injectc++.exe and add 11510 to it. Sounds like you build the exe with base relocation enabled
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
Diedy
Newbie cheater
![]() Reputation: 0
Joined: 15 Jun 2011
Posts: 10
|
| Posted: Sat Jun 25, 2011 6:52 am Post subject: |
|
|
| Dark Byte wrote: | | use module32first/module32next to find the base address of injectc++.exe and add 11510 to it. Sounds like you build the exe with base relocation enabled |
Can you give me an example of how to add addresses together?
Normally I use IntPtr.Add() but using black magic this can't be done because of .NET framework 2.0.
The two addresses I try to add are: 0x00411510 and BM.MainModule.BaseAddress
I also do't get why I should use module32first/module32next.
Thanks again !
Diede
|
|
| Back to top |
|
|
Dark Byte
Site Admin
Reputation: 474
Joined: 09 May 2003
Posts: 25962
Location: The netherlands
|
| Posted: Wed Jun 29, 2011 8:18 am Post subject: |
 |
|
you need to add 0x11510 to BM.MainModule.BaseAddress and make the call go to that address
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
