Endscane Wow 4.3.4 error

[shadowKD]

Hello everyone, I've been trying to figure out how to integrate my code into the game.

On this site I found some code examples, but I started with a problem: when I start my program, my client flies out.
Error: the memory could not be "written"

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using Magic;

namespace Plua
{
    public struct Direct3D
    {
        public static uint Direct3D9__Device = 0xABF47C;
        public static uint Direct3D9__Device__OffsetA = 0x2800;
        public static uint Direct3D9__Device__OffsetB = 0xA8;
    }
    public class HookManager
    {
        private BlackMagic process;
        private bool mainThreadHooked;
        private bool ExecutingCode;

        private uint codeCave;
        private uint injectionAddress;
        private uint returnAddress;

        public HookManager(BlackMagic process)
        {
            this.process = process;

            this.mainThreadHooked = false;
            this.ExecutingCode = false;

            this.codeCave = 0;
            this.injectionAddress = 0;
            this.returnAddress = 0;
        }

        private void HookApplication()
        {
            if (!process.IsProcessOpen)
                throw new Exception("Process is not open");

            uint baseAddress = (uint)process.MainModule.BaseAddress;
            uint pDevice = process.ReadUInt(baseAddress + Direct3D.Direct3D9__Device);
            uint pEnd = process.ReadUInt(pDevice + Direct3D.Direct3D9__Device__OffsetA);
            uint pScene = process.ReadUInt(pEnd);
            uint pEndScene = process.ReadUInt(pScene + Direct3D.Direct3D9__Device__OffsetB);
            if (process.ReadUInt(pEndScene) == 0xE9 && (codeCave == 0 || injectionAddress == 0))
            {
                DisposeOfHook();
            }
            if (process.ReadUInt(pEndScene) != 0xE9)
            {
                try
                {

                    mainThreadHooked = false;

                    codeCave = process.AllocateMemory(2048);
                    injectionAddress = process.AllocateMemory(0x4);

                    process.WriteInt(injectionAddress, 0);

                    returnAddress = process.AllocateMemory(0x4);
                    process.WriteInt(returnAddress, 0);

                    process.Asm.Clear();

                    process.Asm.AddLine("mov edi, edi");
                    process.Asm.AddLine("push ebp");
                    process.Asm.AddLine("mov ebp, esp");

                    

                    //Test for waiting code?
                    process.Asm.AddLine("mov eax, [" + injectionAddress + "]");
                    process.Asm.AddLine("test eax, eax");
                    process.Asm.AddLine("je @out");
                    //Execute waiting code
                    process.Asm.AddLine("mov eax, [" + injectionAddress + "]");
                    process.Asm.AddLine("call eax");

                    //Copy pointer to return value
                    process.Asm.AddLine("mov [" + returnAddress + "], eax");

                    process.Asm.AddLine("mov edx, " + injectionAddress);
                    process.Asm.AddLine("mov ecx, 0");
                    process.Asm.AddLine("mov [edx], ecx");
                    //Close Function
                    process.Asm.AddLine("@out:");
                    //Inject Code
                    uint sizeAsm = (uint)(process.Asm.Assemble().Length);

                    process.Asm.Inject(codeCave);

                    int sizeJumpBack = 5;
                    // create jump back stub
                    process.Asm.Clear();
                    process.Asm.AddLine("jmp " + (pEndScene + sizeJumpBack));
                    process.Asm.Inject(codeCave + sizeAsm + (uint)sizeJumpBack);
                    // create hook jump
                    process.Asm.Clear(); // $jmpto
                    process.Asm.AddLine("jmp " + codeCave);
                    process.Asm.Inject(pEndScene);
                }
                catch
                {
                    mainThreadHooked = false; return;
                }
                mainThreadHooked = true;
            }

        }
        private void DisposeOfHook()
        {
            if (!process.IsProcessOpen)
                throw new Exception("Process is not open");
            uint baseAddress = (uint)process.MainModule.BaseAddress;
            uint pDevice = process.ReadUInt(baseAddress + Direct3D.Direct3D9__Device);
            uint pEnd = process.ReadUInt(pDevice + Direct3D.Direct3D9__Device__OffsetA);
            uint pScene = process.ReadUInt(pEnd);
            uint pEndScene = process.ReadUInt(pScene + Direct3D.Direct3D9__Device__OffsetB);

            try
            {
                if (process.ReadByte(pEndScene) == 0xE9) // check if wow is already hooked and dispose Hook
                {
                    // Restore origine endscene:
                    process.Asm.Clear();
                    process.Asm.AddLine("mov edi, edi");
                    process.Asm.AddLine("push ebp");
                    process.Asm.AddLine("mov ebp, esp");
                    process.Asm.Inject(pEndScene);
                }

                // free memory:
                process.FreeMemory(codeCave);
                process.FreeMemory(injectionAddress);
                process.FreeMemory(returnAddress);
            }
            catch
            {
            }
        }

        public byte[] InjectAndExecute(string[] asm)
        {
            while (ExecutingCode)
            {
                System.Threading.Thread.Sleep(5);
            }
            
            
            ExecutingCode = true;
            HookApplication();
            byte[] tempsByte = new byte[0];

            // reset return value pointer
            process.WriteInt(returnAddress, 0);
            if (process.IsProcessOpen && mainThreadHooked)
            {
                // Write the asm stuff
                process.Asm.Clear();
                foreach (string tempLineAsm in asm)
                {
                    process.Asm.AddLine(tempLineAsm);
                }

                // Allocation Memory
                int codeSize = process.Asm.Assemble().Length;
                uint injectionAsm_Codecave = process.AllocateMemory(codeSize);


                try
                {
                    // Inject
                    process.Asm.Inject(injectionAsm_Codecave);
                    process.WriteInt(injectionAddress, (int)injectionAsm_Codecave);

                    // Wait to launch code
                    while (process.ReadInt(injectionAddress) > 0)
                    {
                        System.Threading.Thread.Sleep(5);
                    }

                    byte Buf = new Byte();
                    List<byte> retnByte = new List<byte>();
                    uint dwAddress = process.ReadUInt(returnAddress);
                    Buf = process.ReadByte(dwAddress);
                    while (Buf != 0)
                    {
                        retnByte.Add(Buf);
                        dwAddress = dwAddress + 1;
                        Buf = process.ReadByte(dwAddress);
                    }
                    tempsByte = retnByte.ToArray();
                }
                catch { }

                // Free memory allocated 
                process.FreeMemory(injectionAsm_Codecave);
            }

            DisposeOfHook();

            ExecutingCode = false;

            return tempsByte;
        }
    }
}

By debugging I found a line because of which my client is down

// create jump back stub
                    process.Asm.Clear();
                    process.Asm.AddLine("jmp " + (pEndScene + sizeJumpBack));
                    process.Asm.Inject(codeCave + sizeAsm + (uint)sizeJumpBack);
                    // create hook jump
                    process.Asm.Clear(); // $jmpto
                    process.Asm.AddLine("jmp " + codeCave);
                    process.Asm.Inject(pEndScene);

Please help me solve this problem

Windows10
DirectX 9


Sorry for my English

[squiggy]

I havent read your code carefully but i recall having a problem using ihook on windows 10. I havent got any other version of windows to compare with but i think the endscene functions differs slightly on win10 which screws up the detour.

Here is the beginning of ensdcene assembly on my win10 computer:

d3d9.dll+43C60 - 6A 20                 - push 20 { 32 }
d3d9.dll+43C62 - B8 477F4670           - mov eax,d3d9.Direct3DCreate9Ex+26397 { [139] }
d3d9.dll+43C67 - E8 F00B0300           - call d3d9.Direct3DCreate9Ex+22CAC
d3d9.dll+43C6C - 8B 7D 08              - mov edi,[ebp+08]
d3d9.dll+43C6F - 33 F6                 - xor esi,esi
.....

I dont think that first push instruction is present on windows 7, but i cant confirm if it is or not.
In any case if you overwrite the first 5 bytes with a jump instruction youre mangling the second mov instruction which explains the crash.

you might get away with just skipping the push and detouring the following mov instruction by hooking at enscene+2 and setting sizeJumpBack to 7.
Or add the push instruction to your trampoline and nop the two trailing bytes (sizeJumpBack = 7)

[shadowKD]

did I understand you correctly?

Do I delete this code?

process.Asm.AddLine("mov edi, edi");
process.Asm.AddLine("push ebp");
process.Asm.AddLine("mov ebp, esp");

Change:

int sizeJumpBack = 5; => int sizeJumpBack = 7;

Did not quite understand where to change enscene+2 ?

[squiggy]

no, i was reffering the the "push 20" instruction.

I dont know if this will fix it but you can try changing:

//uint pEndScene = process.ReadUInt(pScene + Direct3D.Direct3D9__Device__OffsetB);
uint pEndScene = process.ReadUInt(pScene + Direct3D.Direct3D9__Device__OffsetB)+2;

edit: actually, dont change sizeJumpBack, leave it at 5.

[shadowKD]

Unfortunately it did not help((

[namreeb]

Since the 4.3.4 binary has ASLR enabled, the details in your original post are not very helpful. Can you post the complete stack trace from the error log in the wow\errors directory?

[shadowKD]

---------------------------------------
               GxInfo
----------------------------------------
GxApi: D3D9
Shader Model: 3_0
  Vertex: vs_3_0
  Pixel: ps_3_0
Adapter Count: 1

Adapter 0 (primary):
  Driver: aticfx32.dll
  Version: 8.17.0010.1404
  Description: AMD Radeon HD 5700 Series
  DeviceName: \\.\DISPLAY1

------------------------------------------------------------------------------

----------------------------------------
    x86 Registers
----------------------------------------

EAX=00000000  EBX=00000000  ECX=00000000  EDX=00FD0000  ESI=04D17890
EDI=00000000  EBP=00CFF664  ESP=00CFF664  EIP=00FC0026  FLG=00010216
CS =0023      DS =002B      ES =002B      SS =002B      FS =0053      GS =002B


----------------------------------------
    Stack Trace (Manual)
----------------------------------------

Address  Frame    Logical addr  Module

Showing 27/27 threads...

--- Thread ID: 9592 [Current Thread] ---
00FC0026 00CFF664 0000:00000000 <unknown>
00000020 00CFF6BC 0000:00000000 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
017E01E7 00CFF6C8 0001:0043F1E7 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
0179FB11 00CFF794 0001:003FEB11 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
01843E09 00CFF7C4 0001:004A2E09 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
01840DC9 00CFF7EC 0001:0049FDC9 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
0184240A 00CFF840 0001:004A140A C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
01842451 00CFF858 0001:004A1451 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
013A8458 00CFF8EC 0001:00007458 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
746162C4 00CFF900 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 00CFF948 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 00CFF958 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 9156 ---
6A058156 03BCF95C 0001:00057156 C:\Program Files (x86)\Razer\InGameEngine\32bit\rzdspsrv.dll
6A007062 03BCF998 0001:00006062 C:\Program Files (x86)\Razer\InGameEngine\32bit\rzdspsrv.dll
746162C4 03BCF9AC 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 03BCF9F4 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 03BCFA04 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 556 ---
746162C4 043EFB00 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 043EFB48 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 043EFB58 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 8 ---
7702AD52 044EF7E0 0001:000C9D52 C:\Windows\System32\KERNELBASE.dll
0177F69B 044EF818 0001:003DE69B C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
0178393A 044EF82C 0001:003E293A C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
019B2A8E 044EF864 0001:00611A8E C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
019B2B36 044EF870 0001:00611B36 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
746162C4 044EF884 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 044EF8CC 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 044EF8DC 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 3828 ---
7702AD52 045EFA78 0001:000C9D52 C:\Windows\System32\KERNELBASE.dll
0177F69B 045EFAB0 0001:003DE69B C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
0178393A 045EFAC4 0001:003E293A C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
019B2A8E 045EFAFC 0001:00611A8E C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
019B2B36 045EFB08 0001:00611B36 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
746162C4 045EFB1C 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 045EFB64 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 045EFB74 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 5548 ---
77032BCF 050FF9C4 0001:000D1BCF C:\Windows\System32\KERNELBASE.dll
018155DD 050FF9D0 0001:004745DD C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
014DFDF4 050FFA10 0001:0013EDF4 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
01457819 050FFA38 0001:000B6819 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
746162C4 050FFA4C 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 050FFA94 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 050FFAA4 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 1680 ---
746162C4 0777FBDC 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 0777FC24 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 0777FC34 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 4872 ---
77032BCF 0534FC64 0001:000D1BCF C:\Windows\System32\KERNELBASE.dll
01764814 0534FC84 0001:003C3814 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
0178393A 0534FC98 0001:003E293A C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
019B2A8E 0534FCD0 0001:00611A8E C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
019B2B36 0534FCDC 0001:00611B36 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
746162C4 0534FCF0 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 0534FD38 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 0534FD48 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 3652 ---
7702AD52 08DFF750 0001:000C9D52 C:\Windows\System32\KERNELBASE.dll
0145B4B0 08DFF760 0001:000BA4B0 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
017B2052 08DFF778 0001:00411052 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
01457819 08DFF7A0 0001:000B6819 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
746162C4 08DFF7B4 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 08DFF7FC 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 08DFF80C 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 5744 ---
746162C4 099AFD60 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 099AFDA8 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 099AFDB8 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 6220 ---
77032BCF 09AEFDE0 0001:000D1BCF C:\Windows\System32\KERNELBASE.dll
01A30F0D 09AEFDEC 0001:0068FF0D C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
01A3136C 09AEFE00 0001:0069036C C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
746162C4 09AEFE14 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 09AEFE5C 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 09AEFE6C 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 5304 ---
7702AD52 09C2FC2C 0001:000C9D52 C:\Windows\System32\KERNELBASE.dll
0145B4B0 09C2FC3C 0001:000BA4B0 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
014F0475 09C2FC54 0001:0014F475 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
014F05E1 09C2FC60 0001:0014F5E1 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
01457819 09C2FC88 0001:000B6819 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
746162C4 09C2FC9C 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 09C2FCE4 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 09C2FCF4 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 7656 ---
77031A98 09D6F988 0001:000D0A98 C:\Windows\System32\KERNELBASE.dll
014F0C14 09D6FBE4 0001:0014FC14 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
014F033E 09D6FBF0 0001:0014F33E C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
01457819 09D6FC18 0001:000B6819 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
746162C4 09D6FC2C 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 09D6FC74 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 09D6FC84 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 1236 ---
7702AD52 0B7AFCAC 0001:000C9D52 C:\Windows\System32\KERNELBASE.dll
0145B4B0 0B7AFCBC 0001:000BA4B0 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
016A259A 0B7AFCF8 0001:0030159A C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
746162C4 0B7AFD0C 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 0B7AFD54 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 0B7AFD64 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 4888 ---
77031A98 0E31F418 0001:000D0A98 C:\Windows\System32\KERNELBASE.dll
6A01B653 0E31FCAC 0001:0001A653 C:\Program Files (x86)\Razer\InGameEngine\32bit\rzdspsrv.dll
6A01BBC4 0E31FCD8 0001:0001ABC4 C:\Program Files (x86)\Razer\InGameEngine\32bit\rzdspsrv.dll
6A007062 0E31FD14 0001:00006062 C:\Program Files (x86)\Razer\InGameEngine\32bit\rzdspsrv.dll
746162C4 0E31FD28 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 0E31FD70 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 0E31FD80 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 6596 ---
7702AD52 0E8EFCA0 0001:000C9D52 C:\Windows\System32\KERNELBASE.dll
0145B4B0 0E8EFCB0 0001:000BA4B0 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
01AA5E56 0E8EFCC0 0001:00704E56 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
01457819 0E8EFCE8 0001:000B6819 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
746162C4 0E8EFCFC 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 0E8EFD44 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 0E8EFD54 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 4440 ---
7702AD52 19E8FCA4 0001:000C9D52 C:\Windows\System32\KERNELBASE.dll
01A74965 19E8FCC0 0001:006D3965 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
01A310A9 19E8FCD0 0001:006900A9 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
01A31330 19E8FCE4 0001:00690330 C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe
746162C4 19E8FCF8 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 19E8FD40 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 19E8FD50 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 7164 ---
77032BCF 1687F91C 0001:000D1BCF C:\Windows\System32\KERNELBASE.dll
01314A2E 1687FA18 0001:00003A2E c:\users\move-\desktop\ohack_4.3.4\ohack 4.3.4\ohack\ohack.dll
746162C4 1687FA2C 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 1687FA74 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 1687FA84 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 10540 ---
77032BCF 1997FF40 0001:000D1BCF C:\Windows\System32\KERNELBASE.dll
01313BC4 1997FF5C 0001:00002BC4 c:\users\move-\desktop\ohack_4.3.4\ohack 4.3.4\ohack\ohack.dll
746162C4 1997FF70 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 1997FFB8 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 1997FFC8 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 2188 ---
746162C4 166FFF64 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 166FFFAC 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 166FFFBC 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 8132 ---
7702AD52 0CFEF768 0001:000C9D52 C:\Windows\System32\KERNELBASE.dll
66A49E6A 0CFEF784 0001:00078E6A C:\Windows\SYSTEM32\atiumdag.dll
66E689D8 0CFEF7BC 0001:004979D8 C:\Windows\SYSTEM32\atiumdag.dll
66E68B00 0CFEF7C8 0001:00497B00 C:\Windows\SYSTEM32\atiumdag.dll
746162C4 0CFEF7DC 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 0CFEF824 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 0CFEF834 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 6936 ---
7702AD52 0D0EFC54 0001:000C9D52 C:\Windows\System32\KERNELBASE.dll
66A49E6A 0D0EFC70 0001:00078E6A C:\Windows\SYSTEM32\atiumdag.dll
66E689D8 0D0EFCA8 0001:004979D8 C:\Windows\SYSTEM32\atiumdag.dll
66E68B00 0D0EFCB4 0001:00497B00 C:\Windows\SYSTEM32\atiumdag.dll
746162C4 0D0EFCC8 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 0D0EFD10 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 0D0EFD20 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 4180 ---
7702AD52 0D57FEC4 0001:000C9D52 C:\Windows\System32\KERNELBASE.dll
66A49E6A 0D57FEE0 0001:00078E6A C:\Windows\SYSTEM32\atiumdag.dll
66E689D8 0D57FF18 0001:004979D8 C:\Windows\SYSTEM32\atiumdag.dll
66E68B00 0D57FF24 0001:00497B00 C:\Windows\SYSTEM32\atiumdag.dll
746162C4 0D57FF38 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 0D57FF80 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 0D57FF90 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 7272 ---
7702AD52 0D67FB1C 0001:000C9D52 C:\Windows\System32\KERNELBASE.dll
66A49E6A 0D67FB38 0001:00078E6A C:\Windows\SYSTEM32\atiumdag.dll
66E689D8 0D67FB70 0001:004979D8 C:\Windows\SYSTEM32\atiumdag.dll
66E68B00 0D67FB7C 0001:00497B00 C:\Windows\SYSTEM32\atiumdag.dll
746162C4 0D67FB90 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 0D67FBD8 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 0D67FBE8 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 3664 ---
746162C4 0DFAFDC0 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 0DFAFE08 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 0DFAFE18 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 10588 ---
746162C4 0B8CFDD0 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 0B8CFE18 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 0B8CFE28 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

--- Thread ID: 8052 ---
77882A01 0E0AF800 0001:00041A01 C:\Windows\System32\CRYPT32.dll
746162C4 0E0AF814 0001:000062C4 C:\Windows\System32\KERNEL32.DLL
77B80FD9 0E0AF85C 0001:0005FFD9 C:\Windows\SYSTEM32\ntdll.dll
77B80FA4 0E0AF86C 0001:0005FFA4 C:\Windows\SYSTEM32\ntdll.dll

----------------------------------------
    Stack Trace (Using DBGHELP.DLL)
----------------------------------------

Showing 27/27 threads...

--- Thread ID: 9592 [Current Thread] ---
00FC0026 <unknown module> <unknown symbol>+0 (00000020,017F8021,054B1F40,04D17890)
00CFF6BC <unknown module> <unknown symbol>+0 (054B1F40,04D17890,017F8156,01CA7531)
017F8021 WoW.exe      GetBattlenetAllocator+2058545 (00000000,00CFF794,0179FB11,00000000)
017E01E7 WoW.exe      GetBattlenetAllocator+1960695 (00000000,04AE0CE8,04AE0E5C,3F800000)
0179FB11 WoW.exe      GetBattlenetAllocator+1696801 (00000000,00000000,0724C299,04AE0CE8)
01843E09 WoW.exe      GetBattlenetAllocator+2369305 (04AE0CE8,00000016,00000000,01841CB3)
01840DC9 WoW.exe      GetBattlenetAllocator+2356953 (00000000,3CD4FDF4,00000000,69676E45)
0184240A WoW.exe      GetBattlenetAllocator+2362650 (00000000,013A83FF,00000001,00000001)
01842451 WoW.exe      GetBattlenetAllocator+2362721 (013AE4D5,013A0000,00000000,00FF39A3)
013A8458 WoW.exe      <unknown symbol>+0 (00BD2000,746162A0,35287656,00CFF948)
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (00BD2000,36810979,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (013A1190,00BD2000,00000000,00000000)

--- Thread ID: 9156 ---
6A058156 rzdspsrv.dll RddUmInitGlobals+41574 (00000000,2829D094,6A00700B,6A00700B)
6A007062 rzdspsrv.dll <unknown symbol>+0 (0100DFE0,746162A0,365B76FA,03BCF9F4)
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (0100DFE0,35F209C5,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (6A00700B,0100DFE0,00000000,00000000)

--- Thread ID: 556 ---
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (00FF07C8,32700B79,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (77B567C0,00FF07C8,00000000,00000000)

--- Thread ID: 8 ---
7702AD52 KERNELBASE.dll WaitForSingleObject+18 (00002480,FFFFFFFF,0135AAF8,019B2AB4)
0177F69B WoW.exe      GetBattlenetAllocator+1564587 (0135C900,019B2AB4,0135AAF8,044EF864)
0178393A WoW.exe      GetBattlenetAllocator+1581642 (03EC1E40,1BD4DBED,019B2AB4,0135AAF8)
019B2A8E WoW.exe      GetBattlenetAllocator+3871646 (019B2AB4,044EF884,746162C4,0135AAF8)
019B2B36 WoW.exe      GetBattlenetAllocator+3871814 (0135AAF8,746162A0,31A977D2,044EF8CC)
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (0135AAF8,320008FD,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (019B2AB4,0135AAF8,00000000,00000000)

--- Thread ID: 3828 ---
7702AD52 KERNELBASE.dll WaitForSingleObject+18 (00002300,FFFFFFFF,0135B2B0,019B2AB4)
0177F69B WoW.exe      GetBattlenetAllocator+1564587 (0135C960,019B2AB4,0135B2B0,045EFAFC)
0178393A WoW.exe      GetBattlenetAllocator+1581642 (03ED5F78,1BC4D975,019B2AB4,0135B2B0)
019B2A8E WoW.exe      GetBattlenetAllocator+3871646 (019B2AB4,045EFB1C,746162C4,0135B2B0)
019B2B36 WoW.exe      GetBattlenetAllocator+3871814 (0135B2B0,746162A0,31B9744A,045EFB64)
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (0135B2B0,32100B55,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (019B2AB4,0135B2B0,00000000,00000000)

--- Thread ID: 5548 ---

--- Thread ID: 1680 ---
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (0541C9D8,31390C15,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (77B567C0,0541C9D8,00000000,00000000)

--- Thread ID: 4872 ---
77032BCF KERNELBASE.dll Sleep+15 (00000064,019B2AB4,04FF5D20,04FDCEB8)
01764814 WoW.exe      GetBattlenetAllocator+1454372 (00000000,019B2AB4,04FF5D20,0534FCD0)
0178393A WoW.exe      GetBattlenetAllocator+1581642 (04FDCEB8,1AAEDF59,019B2AB4,04FF5D20)
019B2A8E WoW.exe      GetBattlenetAllocator+3871646 (019B2AB4,0534FCF0,746162C4,04FF5D20)
019B2B36 WoW.exe      GetBattlenetAllocator+3871814 (04FF5D20,746162A0,30D373A6,0534FD38)
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (04FF5D20,337A0D09,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (019B2AB4,04FF5D20,00000000,00000000)

--- Thread ID: 3652 ---
7702AD52 KERNELBASE.dll WaitForSingleObject+18 (000002D4,FFFFFFFF,08DFF778,017B2052)
0145B4B0 WoW.exe      <unknown symbol>+0 (FFFFFFFF,000028A4,00000E44,084CFF28)
017B2052 WoW.exe      GetBattlenetAllocator+1771874 (01E5C4D0,01457780,01457780,084CFF28)
01457819 WoW.exe      <unknown symbol>+0 (01D3C558,746162A0,3D3878E2,08DFF7FC)
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (084CFF28,3E9107CD,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (01457780,084CFF28,00000000,00000000)

--- Thread ID: 5744 ---
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (00000000,3FD40D99,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (723535F0,00000000,00000000,00000000)

--- Thread ID: 6220 ---
77032BCF KERNELBASE.dll Sleep+15 (0000000A,09AEFE00,01A3136C,0000000A)
01A30F0D WoW.exe      GetBattlenetAllocator+4388893 (0000000A,01A312F0,0000184C,09AEFE14)
01A3136C WoW.exe      GetBattlenetAllocator+4390012 (087393A8,746162A0,3C497142,09AEFE5C)
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (087393A8,3FE00E6D,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (01A312F0,087393A8,00000000,00000000)

--- Thread ID: 5304 ---
7702AD52 KERNELBASE.dll WaitForSingleObject+18 (00002A74,000003E8,09C2FC54,014F0475)
0145B4B0 WoW.exe      <unknown symbol>+0 (000003E8,000014B8,08831E98,00002B00)
014F0475 WoW.exe      <unknown symbol>+0 (00000000,09C2FC88,01457819,088321E0)
014F05E1 WoW.exe      <unknown symbol>+0 (088321E0,01457780,01457780,08831E98)
01457819 WoW.exe      <unknown symbol>+0 (01D3C578,746162A0,3C2573CA,09C2FCE4)
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (08831E98,3F8C0CD5,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (01457780,08831E98,00000000,00000000)

--- Thread ID: 7656 ---
77031A98 KERNELBASE.dll WaitForMultipleObjects+24 (00000002,09D6FAAC,00000000,000001F4)
014F0C14 WoW.exe      <unknown symbol>+0 (08831F40,09D6FC18,01457819,088321D0)
014F033E WoW.exe      <unknown symbol>+0 (088321D0,01457780,01457780,08831F40)
01457819 WoW.exe      <unknown symbol>+0 (01D3C598,746162A0,3C31737A,09D6FC74)
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (08831F40,3F980C45,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (01457780,08831F40,00000000,00000000)

--- Thread ID: 1236 ---
7702AD52 KERNELBASE.dll WaitForSingleObject+18 (000002D0,FFFFFFFF,0B7AFCF8,016A259A)
0145B4B0 WoW.exe      <unknown symbol>+0 (FFFFFFFF,000004D4,09E50878,00002B10)
016A259A WoW.exe      GetBattlenetAllocator+659114 (01D3C5B8,746162A0,3E9D725A,0B7AFD54)
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (09E50878,3D340D65,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (01457780,09E50878,00000000,00000000)

--- Thread ID: 4888 ---
77031A98 KERNELBASE.dll WaitForMultipleObjects+24 (00000002,0E31F464,00000000,FFFFFFFF)
6A01B653 rzdspsrv.dll <unknown symbol>+0 (07E2A670,6A01BB80,07E2A670,0E31FCB4)
6A01BBC4 rzdspsrv.dll <unknown symbol>+0 (07E2AAA8,25A4D418,6A00700B,6A00700B)
6A007062 rzdspsrv.dll <unknown symbol>+0 (07E2A670,746162A0,3BD6727E,0E31FD70)
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (07E2A670,387F0D41,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (6A00700B,07E2A670,00000000,00000000)

--- Thread ID: 6596 ---
7702AD52 KERNELBASE.dll WaitForSingleObject+18 (00002C54,00000064,0E8EFCC0,01AA5E56)
0145B4B0 WoW.exe      <unknown symbol>+0 (00000064,0AA098F0,0E8EFCE8,01457819)
01AA5E56 WoW.exe      GetBattlenetAllocator+4867942 (0A5285E8,01457780,01457780,0AA098F0)
01457819 WoW.exe      <unknown symbol>+0 (01D3C5D8,746162A0,3B6973AA,0E8EFD44)
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (0AA098F0,38C00D75,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (01457780,0AA098F0,00000000,00000000)

--- Thread ID: 4440 ---
7702AD52 KERNELBASE.dll WaitForSingleObject+18 (00003130,FFFFFFFF,01A312F0,18A75C94)
01A74965 WoW.exe      GetBattlenetAllocator+4665973 (14B27CA0,FFFFFFFF,19E8FCE4,01A31330)
01A310A9 WoW.exe      GetBattlenetAllocator+4389305 (14B27CA0,01A312F0,00001158,19E8FCF8)
01A31330 WoW.exe      GetBattlenetAllocator+4389952 (18A75C94,746162A0,2C0F73AE,19E8FD40)
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (18A75C94,2FA60D71,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (01A312F0,18A75C94,00000000,00000000)

--- Thread ID: 7164 ---
77032BCF KERNELBASE.dll Sleep+15 (00007530,DBB6B0EE,013149E0,013149E0)
01314A2E ohack.dll    <unknown symbol>+0 (00000000,746162A0,2360757A,1687FA74)
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (00000000,20C90A45,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (013149E0,00000000,00000000,00000000)

--- Thread ID: 10540 ---
77032BCF KERNELBASE.dll Sleep+15 (00000064,01313BB0,01313BB0,00000000)
01313BC4 ohack.dll    <unknown symbol>+0 (00000000,746162A0,2C707026,1997FFB8)
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (00000000,2FD90F89,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (01313BB0,00000000,00000000,00000000)

--- Thread ID: 2188 ---
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (010382A0,20210F9D,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (77B567C0,010382A0,00000000,00000000)

--- Thread ID: 8132 ---
7702AD52 KERNELBASE.dll WaitForSingleObject+18 (00004200,FFFFFFFF,010D1CC8,66E68A84)
66A49E6A atiumdag.dll XdxInitXopAdapterServices+182362 (270D1A10,548EBFCB,66E68A84,010D2BE8)
66E689D8 atiumdag.dll XdxInitXopAdapterServices+4502472 (66E68A84,0CFEF7DC,746162C4,010D1CC8)
66E68B00 atiumdag.dll XdxInitXopAdapterServices+4502768 (010D1CC8,746162A0,3919788A,0CFEF824)
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (010D1CC8,3AB00815,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (66E68A84,010D1CC8,00000000,00000000)

--- Thread ID: 6936 ---
7702AD52 KERNELBASE.dll WaitForSingleObject+18 (00004210,FFFFFFFF,010D2090,66E68A84)
66A49E6A atiumdag.dll XdxInitXopAdapterServices+182362 (270D1A34,557EB4DF,66E68A84,2602AF58)
66E689D8 atiumdag.dll XdxInitXopAdapterServices+4502472 (66E68A84,0D0EFCC8,746162C4,010D2090)
66E68B00 atiumdag.dll XdxInitXopAdapterServices+4502768 (010D2090,746162A0,38E9739E,0D0EFD10)
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (010D2090,3B400D21,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (66E68A84,010D2090,00000000,00000000)

--- Thread ID: 4180 ---
7702AD52 KERNELBASE.dll WaitForSingleObject+18 (00004220,FFFFFFFF,010D2FB0,66E68A84)
66A49E6A atiumdag.dll XdxInitXopAdapterServices+182362 (270D1A58,5527B76F,66E68A84,2602B320)
66E689D8 atiumdag.dll XdxInitXopAdapterServices+4502472 (66E68A84,0D57FF38,746162C4,010D2FB0)
66E68B00 atiumdag.dll XdxInitXopAdapterServices+4502768 (010D2FB0,746162A0,38B0706E,0D57FF80)
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (010D2FB0,3B190FB1,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (66E68A84,010D2FB0,00000000,00000000)

--- Thread ID: 7272 ---
7702AD52 KERNELBASE.dll WaitForSingleObject+18 (00004230,FFFFFFFF,010D3740,66E68A84)
66A49E6A atiumdag.dll XdxInitXopAdapterServices+182362 (270D1A7C,5517B307,66E68A84,2602B6E8)
66E689D8 atiumdag.dll XdxInitXopAdapterServices+4502472 (66E68A84,0D67FB90,746162C4,010D3740)
66E68B00 atiumdag.dll XdxInitXopAdapterServices+4502768 (010D3740,746162A0,388074C6,0D67FBD8)
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (010D3740,3B290BE9,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (66E68A84,010D3740,00000000,00000000)

--- Thread ID: 3664 ---
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (010382A0,3BB40E39,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (77B567C0,010382A0,00000000,00000000)

--- Thread ID: 10588 ---
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (00FF07C8,3DC20E29,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (77B567C0,00FF07C8,00000000,00000000)

--- Thread ID: 8052 ---
77882A01 CRYPT32.dll  I_CryptSetTls+721 (01045AF0,746162A0,3BED7742,0E0AF85C)
746162C4 KERNEL32.DLL BaseThreadInitThunk+36 (01045AF0,3844086D,00000000,00000000)
77B80FD9 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1081 (FFFFFFFF,77BA2F00,00000000,00000000)
77B80FA4 ntdll.dll    RtlSubscribeWnfStateChangeNotification+1028 (778829D0,01045AF0,00000000,00000000)



----------------------------------------
    Loaded Modules
----------------------------------------

DBG-MODULE<01310000 00033000 "ohack.dll" "OHack.pdb" 0 {548ae391-c798-4b39-98d040b484d655ea} 203 1343671221>
DBG-MODULE<013A0000 00CDC000 "WoW.exe" "Wow.pdb" 0 {9a9fe68a-1174-4bdf-b51a0cab2be97eae} 1 1334105658>
DBG-MODULE<0BC90000 00008000 "midimap.dll" "midimap.pdb" 0 {282badb0-b8be-4d46-971189b06aff60f6} 1 1468633358>
DBG-MODULE<0F410000 00036000 "DINPUT8.dll" "dinput8.pdb" 0 {89d1b2a0-74ae-4319-a83be4bf2d12cdd4} 1 1468633301>
DBG-MODULE<0F980000 00019000 "RazerHook32.dll" "RazerHook32.pdb" 0 {151df544-c0c0-4719-a9d6e053da4a4195} 1 1463764544>
DBG-MODULE<3DDD0000 00141000 "dbghelp.dll" "dbghelp.pdb" 0 {24f6937d-6631-40a2-aff3210434afba90} 1 1265054906>
DBG-MODULE<51520000 00007000 "ksuser.dll" "ksuser.pdb" 0 {ee69ccfe-0703-4588-972a15ccbdd7a381} 1 1468632681>
DBG-MODULE<60AB0000 0014F000 "PROPSYS.dll" "propsys.pdb" 0 {906054ac-f41d-4c35-9aed26871b349b6d} 1 1468633027>
DBG-MODULE<60C00000 00058000 "MMDevApi.dll" "MMDevAPI.pdb" 0 {dff0f5e6-9d00-4b15-b815c5fadf95b40b} 1 1468632939>
DBG-MODULE<60C60000 000CF000 "wintypes.dll" "WinTypes.pdb" 0 {0506d8ed-f0ca-4128-9211073816a25980} 1 1481274947>
DBG-MODULE<60D30000 0007B000 "AUDIOSES.DLL" "audioses.pdb" 0 {0fc760a7-62de-4199-a4d3acdca159431e} 1 1478084018>
DBG-MODULE<61160000 000ED000 "DDRAW.dll" "ddraw.pdb" 0 {fb4535f5-f730-496b-85bc0a9fb08a94db} 1 1478083221>
DBG-MODULE<64160000 00039000 "wdmaud.drv" "wdmaud.pdb" 0 {eac20a34-4fff-4a56-acd1ef521035136c} 1 1468632760>
DBG-MODULE<64510000 00025000 "GLU32.dll" "glu32.pdb" 0 {ef0a8f8a-d1b1-4d7c-8cc77d9e331003ee} 1 1468633350>
DBG-MODULE<64540000 000E0000 "OPENGL32.dll" "opengl32.pdb" 0 {354f17f2-adbb-4a4e-84c6370e9753a50c} 1 1468633246>
DBG-MODULE<64750000 00018000 "MSACM32.dll" "msacm32.pdb" 0 {8296cbeb-e205-4fcf-8bfd230143660ca7} 1 1468632951>
DBG-MODULE<64890000 00085000 "mscms.dll" "mscms.pdb" 0 {5f82dd14-a2c6-4ff4-a4d2e2e97798508b} 1 1468633018>
DBG-MODULE<66230000 00799000 "atiumdva.dll" "atiumdva.pdb" 0 {1e25e7c4-ea4f-471f-9e86474987e5df6e} 1 1446672123>
DBG-MODULE<669D0000 0070C000 "atiumdag.dll" "atiumdag.pdb" 0 {6a314c47-bc0d-4840-9128b972b4f93804} 1 1446672013>
DBG-MODULE<67280000 00084000 "dxgi.dll" "dxgi.pdb" 0 {bf2ccd11-1cad-4562-a7aeee48e0ccdc3e} 1 1478848496>
DBG-MODULE<67310000 00194000 "urlmon.dll" "urlmon.pdb" 0 {9be29d12-40a6-4320-aa0893e6e0426d51} 1 1478847860>
DBG-MODULE<67850000 00128000 "aticfx32.dll" "aticfx32.pdb" 0 {1277a636-231a-4ed5-a95020131dde91d4} 1 1446672646>
DBG-MODULE<67980000 0015F000 "d3d9.dll" "d3d9.pdb" 0 {3ff4ee10-325a-4f4b-9eb648a66be8031d} 1 1478082425>
DBG-MODULE<6A000000 00100000 "rzdspsrv.dll" "RzDspSrv.pdb" 0 {bb26ed1c-734a-4206-a0a2fe0fd43e66e6} 1 1474929294>
DBG-MODULE<6A1E0000 00094000 "COMCTL32.dll" "comctl32v582.pdb" 0 {64683aca-2a86-4125-9dd5ab6134f2039e} 1 1478083279>
DBG-MODULE<6ABA0000 00025000 "cryptnet.dll" "cryptnet.pdb" 0 {22ca9f62-bb4e-4ba5-82e64f032e550f1c} 1 1468633290>
DBG-MODULE<6ACE0000 0038B000 "msi.dll" "msi.pdb" 0 {0d39a0d3-a356-411e-865428afb246c0fd} 1 1481275881>
DBG-MODULE<6B250000 0000A000 "msacm32.drv" "msacm32.pdb" 0 {90bfe0b5-161d-4a05-98cf0ba939952500} 1 1468633359>
DBG-MODULE<6BA40000 00007000 "DCIMAN32.dll" "dciman32.pdb" 0 {fc9b4ed5-0baf-4c77-bee25d38e4258b5e} 1 1468633497>
DBG-MODULE<6C4F0000 0001B000 "ncryptsslp.dll" "ncryptsslp.pdb" 0 {f971ec8d-6905-4cf9-a58be068403867b0} 1 1468633408>
DBG-MODULE<6C510000 0002B000 "NTASN1.dll" "ntasn1.pdb" 0 {8896f39f-7b46-45c1-9a40d4abd7f37fae} 1 1468633323>
DBG-MODULE<6C540000 00020000 "ncrypt.dll" "ncrypt.pdb" 0 {b84a7f95-8271-4ec7-953cbaca717d5ac8} 1 1468633271>
DBG-MODULE<6C560000 00011000 "mskeyprotect.dll" "mskeyprotect.pdb" 0 {045364f9-758f-4be1-ae9c39522d9b46cf} 1 1468633316>
DBG-MODULE<6C580000 00064000 "schannel.dll" "schannel.pdb" 0 {ea934f44-cd92-46a7-a2ff2095b573fc28} 1 1471669608>
DBG-MODULE<6CE20000 00010000 "ondemandconnroutehelper.dll" "OnDemandConnRouteHelper.pdb" 0 {2a3fcc1a-c908-4f59-82240c1d32db75bb} 1 1468633317>
DBG-MODULE<6D7B0000 00008000 "WINNSI.DLL" "winnsi.pdb" 0 {2d77828a-f81a-47b3-b47d09b96d30efad} 1 1468633416>
DBG-MODULE<6DFF0000 00022000 "DEVOBJ.dll" "devobj.pdb" 0 {e4522cdc-8256-4e0d-aba1f4c7dbd3c694} 1 1468633329>
DBG-MODULE<6E0B0000 0004E000 "mswsock.dll" "wmswsock.pdb" 0 {b8012b8e-7672-43c7-bc86136520c8088d} 1 1468633253>
DBG-MODULE<71AB0000 0006A000 "WINSPOOL.DRV" "winspool.pdb" 0 {b096eb97-2b20-4812-b2eadd5f07c45206} 1 1468633154>
DBG-MODULE<71B20000 00008000 "DPAPI.DLL" "dpapi.pdb" 0 {6fc224db-0b7d-4918-bedcd10d2016dc1e} 1 1468633414>
DBG-MODULE<71CA0000 0002F000 "aswhookx.dll" "aswhookx.pdb" 0 {9578692e-9b13-4ab7-9144bea8d6865d92} 3 1499845676>
DBG-MODULE<72060000 0001C000 "atiu9pag.dll" "atiu9pag.pdb" 0 {9471cb04-93f3-4981-857be80094325d37} 2 1446671774>
DBG-MODULE<72310000 0000A000 "HID.DLL" "hid.pdb" 0 {e85e7b7b-1771-47e0-93978e65aec3469e} 1 1468633315>
DBG-MODULE<72320000 00023000 "WINMMBASE.dll" "WINMMBASE.pdb" 0 {3823fcf3-bd52-4c22-96628e386f771753} 1 1468633248>
DBG-MODULE<72350000 00024000 "WINMM.dll" "winmm.pdb" 0 {cdf8968e-1835-4435-8d246e314f1dcf2d} 1 1468633262>
DBG-MODULE<72380000 0001F000 "dwmapi.dll" "dwmapi.pdb" 0 {191cdad7-560a-4cff-9e19594206a9922d} 1 1473958517>
DBG-MODULE<723E0000 00016000 "MPR.dll" "mpr.pdb" 0 {d3a25378-b330-497f-8062c9e86915304e} 1 1468633311>
DBG-MODULE<72400000 00075000 "uxtheme.dll" "wUxTheme.pdb" 0 {d5e91b99-1eeb-4100-835484a8811df0c7} 1 1468633252>
DBG-MODULE<72480000 00049000 "fwpuclnt.dll" "fwpuclnt.pdb" 0 {932cf037-5ae5-450e-9797d9ae96752986} 1 1468632508>
DBG-MODULE<724D0000 00229000 "iertutil.dll" "iertutil.pdb" 0 {8a5e0de6-f32e-4988-8173b94b464174fd} 1 1478083187>
DBG-MODULE<72C10000 00008000 "rasadhlp.dll" "rasadhlp.pdb" 0 {2d4a6a2a-94b5-4a73-ac505e006b2769db} 1 1468633352>
DBG-MODULE<72C50000 00092000 "apphelp.dll" "apphelp.pdb" 0 {8daf7773-372f-460a-af38944e193f7e33} 1 1468632811>
DBG-MODULE<72DA0000 0001A000 "USERENV.dll" "userenv.pdb" 0 {c6055b8f-efcd-430e-8ad2ebaa6c89b312} 1 1468633361>
DBG-MODULE<738D0000 0001B000 "bcrypt.dll" "bcrypt.pdb" 0 {befd22f9-21c0-4067-b22bb4cc1e8ed238} 1 1481276448>
DBG-MODULE<738F0000 0002F000 "rsaenh.dll" "rsaenh.pdb" 0 {5902506e-7270-4d3e-b269621ac37c3d6c} 1 1468633306>
DBG-MODULE<73920000 00013000 "CRYPTSP.dll" "cryptsp.pdb" 0 {242e08ad-8d59-41db-96103659e00b0dc6} 1 1468633392>
DBG-MODULE<73B70000 0002F000 "IPHLPAPI.DLL" "iphlpapi.pdb" 0 {b6a96061-3b9a-4bee-99d7f8380731e80a} 1 1468632620>
DBG-MODULE<73BA0000 0007C000 "DNSAPI.dll" "dnsapi.pdb" 0 {3db5e8f3-f006-48d3-b3b03876705ae1e1} 1 1473958479>
DBG-MODULE<73C20000 000A0000 "winhttp.dll" "winhttp.pdb" 0 {7519075e-f65f-48f5-bdabf941c7c63dbf} 1 1476503057>
DBG-MODULE<73CC0000 0022F000 "WININET.dll" "wininet.pdb" 0 {004b475f-74b4-4680-88207914c828d8ce} 1 1478847820>
DBG-MODULE<73EF0000 00008000 "VERSION.dll" "version.pdb" 0 {f4f28743-a796-4a2f-9063f3806f5b241e} 1 1468633370>
DBG-MODULE<745D0000 0000A000 "CRYPTBASE.dll" "cryptbase.pdb" 0 {147c51fb-7ca1-408f-85b5285f2ad6f9c5} 1 1468633409>
DBG-MODULE<745E0000 0001E000 "SspiCli.dll" "wsspicli.pdb" 0 {02af06f6-c053-4908-839f21c9717ba387} 1 1481276566>
DBG-MODULE<74600000 000E0000 "KERNEL32.DLL" "wkernel32.pdb" 0 {e88980d9-5f99-41fb-ae728782d05d8c5b} 1 1468632822>
DBG-MODULE<746E0000 0000D000 "kernel.appcore.dll" "Kernel.Appcore.pdb" 0 {f153f70e-5b49-49d2-98a676105044a538} 1 1468633455>
DBG-MODULE<746F0000 00015000 "win32u.dll" "wwin32u.pdb" 0 {4253c2d4-c64b-485e-ae885c92fa9f1489} 1 1470112706>
DBG-MODULE<74710000 000EA000 "ole32.dll" "ole32.pdb" 0 {383371e9-f27f-45a0-89e849eb6a8a87bb} 1 1481275741>
DBG-MODULE<74800000 0040B000 "SETUPAPI.dll" "setupapi.pdb" 0 {107e91ca-7d25-4754-b96049cf5de16e0f} 1 1468632800>
DBG-MODULE<74C10000 00077000 "ADVAPI32.dll" "advapi32.pdb" 0 {c402b2ee-60d8-415f-9748c25cd8ca595c} 1 1468633007>
DBG-MODULE<74C90000 00084000 "clbcatq.dll" "CLBCatQ.pdb" 0 {37efe8a0-12e9-4493-9e2bfa3b53672940} 1 1468632771>
DBG-MODULE<74D20000 00045000 "powrprof.dll" "powrprof.pdb" 0 {25429585-0b0f-4f0c-900c76a9835342d7} 1 1468632871>
DBG-MODULE<74E70000 00036000 "cfgmgr32.dll" "cfgmgr32.pdb" 0 {de8b8fea-e8a4-4dc7-adf9674ffef9411f} 1 1468633302>
DBG-MODULE<74F20000 0005A000 "bcryptPrimitives.dll" "bcryptprimitives.pdb" 0 {14fb4702-5967-46b4-a6726bf051852070} 1 1468633352>
DBG-MODULE<74F80000 0015F000 "USER32.dll" "wuser32.pdb" 0 {b4191117-c94c-48f4-9e8d0d7e428fe239} 1 1481275955>
DBG-MODULE<750E0000 0015B000 "gdi32full.dll" "wgdi32full.pdb" 0 {a76794c1-a50b-43c8-8fa3d1ba7832fc53} 1 1481276192>
DBG-MODULE<75240000 013D9000 "SHELL32.dll" "shell32.pdb" 0 {6350d937-a601-4653-8d02a82227d5df44} 1 1482294582>
DBG-MODULE<76620000 00044000 "WINTRUST.dll" "wintrust.pdb" 0 {7ba7fcb0-582d-420e-80abac69775b75e0} 1 1476503778>
DBG-MODULE<76670000 00046000 "SHLWAPI.dll" "shlwapi.pdb" 0 {8b345e6f-8be4-4617-a11ee6e1e4393c2e} 1 1468633018>
DBG-MODULE<766C0000 00211000 "combase.dll" "combase.pdb" 0 {a9819d7c-64b4-4ca6-87e15f11afe004f4} 1 1481275066>
DBG-MODULE<768E0000 0056E000 "windows.storage.dll" "Windows.Storage.pdb" 0 {2c24107e-91a7-46df-be259ee10a6df553} 1 1478848235>
DBG-MODULE<76E50000 00094000 "OLEAUT32.dll" "oleaut32.pdb" 0 {7f44166c-d334-4657-beaba3328b5a50aa} 1 1478083253>
DBG-MODULE<76EF0000 00063000 "WS2_32.dll" "ws2_32.pdb" 0 {ec49255a-7c17-45e5-80816aff78ea7238} 1 1473958525>
DBG-MODULE<76F60000 001A1000 "KERNELBASE.dll" "wkernelbase.pdb" 0 {4dad89fb-1107-4417-9a0b1d6a168d930d} 1 1478847799>
DBG-MODULE<77110000 000BE000 "msvcrt.dll" "msvcrt.pdb" 0 {6f6409b3-d520-43c7-9b2f62e00bfe761c} 1 1468633429>
DBG-MODULE<771D0000 000C1000 "RPCRT4.dll" "wrpcrt4.pdb" 0 {779f5fcb-8724-4c71-bd26688a262ce546} 1 1470454626>
DBG-MODULE<772A0000 0000E000 "MSASN1.dll" "msasn1.pdb" 0 {69378605-b036-43db-a04d5fd47e3b55be} 1 1468633428>
DBG-MODULE<772B0000 00025000 "IMM32.dll" "wimm32.pdb" 0 {7eab6e49-2a33-4b56-a377e394a8a96529} 1 1468633328>
DBG-MODULE<772E0000 0007B000 "msvcp_win.dll" "msvcp_win.pdb" 0 {97b2b854-b345-4bfe-933a3c00ed82f6cc} 1 1468633244>
DBG-MODULE<77360000 00135000 "MSCTF.dll" "msctf.pdb" 0 {6623256c-4574-465f-81cc1cb26d3b67f6} 1 1478847664>
DBG-MODULE<77610000 00007000 "NSI.dll" "nsi.pdb" 0 {17de91e0-8875-4beb-b9c608370ad5a862} 1 1468633462>
DBG-MODULE<77620000 000E0000 "ucrtbase.dll" "ucrtbase.pdb" 0 {14e1ccbe-c74d-4ce0-9b29cad25bf7ec9d} 1 1468632498>
DBG-MODULE<77700000 00041000 "sechost.dll" "sechost.pdb" 0 {461fde22-07b6-457c-b48d249272cbb736} 1 1468633199>
DBG-MODULE<77750000 000E5000 "COMDLG32.dll" "comdlg32.pdb" 0 {e05523d1-780d-47b5-b1423c09dbd74c8d} 1 1478847867>
DBG-MODULE<77840000 0017D000 "CRYPT32.dll" "crypt32.pdb" 0 {2bc81fd4-d23a-4873-bf7506ac5f62c46f} 1 1476502686>
DBG-MODULE<779C0000 0000F000 "profapi.dll" "profapi.pdb" 0 {fd1838c1-0b52-47d4-9a399dc796d207cd} 1 1468633377>
DBG-MODULE<779D0000 0002B000 "GDI32.dll" "wgdi32.pdb" 0 {e04d9aeb-7e31-40ca-8bd0a75eedaa0e9f} 1 1473958602>
DBG-MODULE<77A00000 00006000 "psapi.dll" "psapi.pdb" 0 {74156f15-7566-416e-b87f0f28b7d7df26} 1 1468632848>
DBG-MODULE<77A10000 00088000 "shcore.dll" "shcore.pdb" 0 {97504c6a-0b25-405a-aadfefc1478f36b1} 1 1468632653>
DBG-MODULE<77B20000 00183000 "ntdll.dll" "wntdll.pdb" 0 {9d5ebb42-7b34-49c0-ba160009a9070625} 1 1478847648>
DBG-MODULE<77D90000 00009000 "AVRT.dll" "avrt.pdb" 0 {b3b7afa8-e992-4ff9-a11e4321f4a6bff2} 1 1468632796>
DBG-MODULE<788D0000 0007A000 "AcSpecfc.DLL" "AcSpecfc.pdb" 0 {0d9037be-abfd-4b59-b947c6b3e1957c80} 1 1476503345>

----------------------------------------
    Memory Dump
----------------------------------------

Code: 16 bytes starting at (EIP = 00FC0026)

00FC0026: <can't read from this address>


Stack: 1024 bytes starting at (ESP = 00CFF664)

* = addr               **                                         *           
00CFF660: 00 00 00 00  BC F6 CF 00  20 00 00 00  21 80 7F 01  ........ ...!...
00CFF670: 40 1F 4B 05  90 78 D1 04  56 81 7F 01  31 75 CA 01  @.K..x..V...1u..
00CFF680: C8 2A FE 04  60 B4 F5 03  C8 2A FE 04  A8 F6 CF 00  .*..`....*......
00CFF690: D4 30 5B 01  02 00 00 00  31 75 CA 01  00 00 00 00  .0[.....1u......
00CFF6A0: 00 00 00 00  00 00 80 3F  94 F7 CF 00  B8 FA 79 01  .......?......y.
00CFF6B0: 02 00 00 00  88 F7 CF 00  00 00 00 00  C8 F6 CF 00  ................
00CFF6C0: E7 01 7E 01  00 00 00 00  94 F7 CF 00  11 FB 79 01  ..~...........y.
00CFF6D0: 00 00 00 00  E8 0C AE 04  5C 0E AE 04  00 00 80 3F  ........\......?
00CFF6E0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00CFF6F0: 00 00 80 3F  00 00 00 00  00 00 00 00  00 00 00 00  ...?............
00CFF700: 00 00 00 00  00 00 80 3F  00 00 00 00  00 00 00 00  .......?........
00CFF710: 00 00 00 00  00 00 00 00  00 00 80 3F  00 00 00 40  ...........?...@
00CFF720: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00CFF730: 00 00 00 40  00 00 00 00  00 00 00 00  00 00 00 00  ...@............
00CFF740: 00 00 00 00  6F 12 83 3B  00 00 00 00  7B 14 80 BF  ....o..;....{...
00CFF750: 2F B7 7F BF  00 00 80 BF  00 00 80 3F  00 00 00 00  /..........?....
00CFF760: 00 00 00 00  00 00 00 00  00 00 80 3F  00 00 00 00  ...........?....
00CFF770: 00 00 80 3F  00 00 80 3F  00 00 80 3F  00 00 00 00  ...?...?...?....
00CFF780: 00 00 80 3F  00 00 00 00  00 00 00 00  00 00 00 00  ...?............
00CFF790: 00 00 00 00  C4 F7 CF 00  09 3E 84 01  00 00 00 00  .........>......
00CFF7A0: 00 00 00 00  99 C2 24 07  E8 0C AE 04  60 B4 F5 03  ......$.....`...
00CFF7B0: 61 0E AE 04  F8 0C AE 04  E8 0C AE 04  00 00 00 00  a...............
00CFF7C0: 01 00 00 00  EC F7 CF 00  C9 0D 84 01  E8 0C AE 04  ................
00CFF7D0: 16 00 00 00  00 00 00 00  B3 1C 84 01  FE FF FF FF  ................
00CFF7E0: 00 00 00 00  01 00 00 00  00 00 00 00  40 F8 CF 00  ............@...
00CFF7F0: 0A 24 84 01  00 00 00 00  F4 FD D4 3C  00 00 00 00  .$.........<....
00CFF800: 45 6E 67 69  6E 65 20 32  35 37 38 00  02 00 00 00  Engine 2578.....
00CFF810: 04 00 00 00  F0 25 00 01  2C F8 CF 00  32 5B B6 77  .....%..,...2[.w
00CFF820: FE FF FF FF  F0 25 00 01  FE FF FF FF  9C E6 B8 77  .....%.........w
00CFF830: E0 3B 03 77  EC 22 00 00  00 00 00 00  58 F8 CF 00  .;.w."......X...
00CFF840: 58 F8 CF 00  51 24 84 01  00 00 00 00  FF 83 3A 01  X...Q$........:.
00CFF850: 01 00 00 00  01 00 00 00  EC F8 CF 00  58 84 3A 01  ............X.:.
00CFF860: D5 E4 3A 01  00 00 3A 01  00 00 00 00  A3 39 FF 00  ..:...:......9..
00CFF870: 01 00 00 00  65 DB 55 1F  90 11 3A 01  90 11 3A 01  ....e.U...:...:.
00CFF880: 00 20 BD 00  44 00 00 00  58 98 FF 00  98 4F 00 01  . ..D...X....O..
00CFF890: 98 BF FF 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00CFF8A0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00CFF8B0: 01 0C 00 00  01 00 00 00  00 00 00 00  00 00 00 00  ................
00CFF8C0: 01 00 01 00  00 00 00 00  05 00 00 C0  90 11 3A 01  ..............:.
00CFF8D0: 00 00 00 00  74 F8 CF 00  14 F2 CF 00  38 F9 CF 00  ....t.......8...
00CFF8E0: B0 1B 3B 01  21 D6 58 1E  01 00 00 00  00 F9 CF 00  ..;.!.X.........
00CFF8F0: C4 62 61 74  00 20 BD 00  A0 62 61 74  56 76 28 35  .bat. ...batVv(5
00CFF900: 48 F9 CF 00  D9 0F B8 77  00 20 BD 00  79 09 81 36  H......w. ..y..6
00CFF910: 00 00 00 00  00 00 00 00  00 20 BD 00  05 00 00 C0  ......... ......
00CFF920: 00 00 00 00  F4 F1 CF 00  A0 D2 0B 77  79 09 81 36  ...........wy..6
00CFF930: 0C F9 CF 00  F4 F1 CF 00  50 F9 CF 00  B0 67 B9 77  ........P....g.w
00CFF940: 21 77 8F 41  00 00 00 00  58 F9 CF 00  A4 0F B8 77  !w.A....X......w
00CFF950: FF FF FF FF  00 2F BA 77  00 00 00 00  00 00 00 00  ...../.w........
00CFF960: 90 11 3A 01  00 20 BD 00  00 00 00 00  00 00 00 00  ..:.. ..........
00CFF970: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00CFF980: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00CFF990: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00CFF9A0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00CFF9B0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00CFF9C0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00CFF9D0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00CFF9E0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00CFF9F0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00CFFA00: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00CFFA10: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00CFFA20: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00CFFA30: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00CFFA40: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00CFFA50: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00CFFA60: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................


------------------------------------------------------------------------------
Percent memory used:    52
Total physical memory:  10736484352
Free physical memory:   5083803648
Page file:              12682641408
Total virtual memory:   4294836224
Free virtual memory:    3178049536
------------------------------------------------------------------------------

List of running WoW processes:

Process: C:\Users\move-\Downloads\WoWCircle 4.3.4\WoW.exe; pid: 9908


Exception handler died
Original exception:
0xC0000005 (ACCESS_VIOLATION) at 0023:0B7E0002
The instruction at "0x0B7E0002" referenced memory at "0x00000000".
The memory could not be "written".

I will be very grateful if you will help to solve this problem))

[tutrakan]

Since you really have no idea what you are doing I will allow myself a little bit preaching before my answer.

If you investigate some time learning the following examples, you will save more time and you will advance faster:

1. Best choice - Using c++ and injecting your whole program as dll. Since you are injecting c++ code into game written in c++, there will be less code and best efficiency. Example: WowAddin made by tomrus88.
2. If you want to stick with c# - you can learn the stschake’s example and his project (it’s even written for cata): cleanCore.
You can find these two in github.com.
3. Worst choice (not recommended at all!) – using the dinosaur’s age blackmagic and fasm and struggling with injection of small pieces of pseudo asm code while still in c#.

That’s the choice you have taken and if you still didn’t change your mind there you are:
Hook this function (is zero rebased):

 void __thiscall sub_458000(int this)
{
  int v1; // esi@1
  int v2; // eax@2
  bool v3; // zf@2
  bool v4; // sf@2
  unsigned __int8 v5; // of@2
  char *v6; // ebx@3
  char *v7; // edi@8
  int v8; // eax@10
  int v9; // edi@15

  v1 = this;
  if ( *(this + 0x29BC) )
  {
    (*(**(this + 0x2800) + 0xA8))(*(this + 0x2800));

...

I think it name is CGxDeviceD3d::ISceneEnd() and is called by CGxDeviceD3d::ScenePresent().
Then the Direct3D9__Device should be in the ecx(this) register if *(this + 0x29BC) != 0. Or, you can just hook CGxDeviceD3d::ISceneEnd() instead on the adapter’s driver end scene function itself.

[namreeb]

It looks like you're calling EndScene before the device has been created.

[shadowKD]

Unfortunately, I'm not very strong in the implementation of endscene, is there any way to fix my code? In theory, I understand the problem roughly.
But I myself unfortunately can not realize (

tutrakan, thank you very much for the help. I will definitely study the cleanCore project.