A question about GW2 remote inject

[oraclex]

I'm new in coding and analysis.
I tried to remote inject GW2 to test some function call many times,crashed everytime.I use a injector called CodeinEX.
I have no idea why.I tried to inject ff14 and some others before,and successed.
Can anyone help me?
thanks

[karliky]

Would be great if you post some example code

[oraclex]

sorry for poor english

this is an example,open an vendor npc,will pop a window.
below is the function of click the "buy" "sell""buyback"tag
I use CE to search this 3 tag ,found that,there is one address,when buy,it was 0,sell:1,buyback:2
then I find write to,with this

0044A104 - 8B 0E - mov ecx,[esi]
0044A106 - 8B D3 - mov edx,ebx
0044A108 - 89 1F - mov [edi],ebx <<
0044A10A - E8 F1C57100 - call Gw2.exe+766700
0044A10F - 8B D8 - mov ebx,eax

EAX=00000000
EBX=00000001
ECX=00000532
EDX=00000001
ESI=0F2E9C30
EDI=0F2E9C34
ESP=3BC9FC10
EBP=3BC9FC1C
EIP=0044A10A

I trace it in OD ,I translate some word in OD to english
3BC9FC20 |0044B3E1 return to Gw2.0044B3E1 from Gw2.0044A0B0

3BC9FC2C |0044F15F ret to Gw2.0044F15F from Gw2.0044B3B0

3BC9FC44 |00B75A82 ret toGw2.00B75A82

3BC9FC70 |00B75D45 ret to Gw2.00B75D45 from Gw2.00B75A00

3BC9FCAC |00B6598C ret to Gw2.00B6598C from Gw2.00B75C60

after test I think 3BC9FC20 |0044B3E1 ret to Gw2.0044B3E1 from Gw2.0044A0B0 should be the call I was looking for

It only break when I click different tag,the other call break immediately or will break when open the window.

the environment of the call Gw2.0044A0B0

0044B3D5 C2 0400 retn 0x4
0044B3D8 8B52 04 mov edx,dword ptr ds:[edx+0x4] ; ebx = the number of the tag buy sell buyback
0044B3DB 52 push edx ;
0044B3DC E8 CFECFFFF call Gw2.0044A0B0
0044B3E1 5D pop ebp
0044B3E2 C2 0400 retn 0x4
;

The beginning of the call Gw2.0044A0B0
0044A0B0 55 push ebp ;
0044A0B1 8BEC mov ebp,esp
0044A0B3 53 push ebx ;
0044A0B4 8B5D 08 mov ebx,dword ptr ss:[ebp+0x8] ; the push thing
0044A0B7 56 push esi ;
0044A0B8 8BF1 mov esi,ecx ; I think this is needed to use this call,maybe the ID of this window,the same with the same window ,reopen will be different
0044A0BA 8B46 04 mov eax,dword ptr ds:[esi+0x4] ; the original number of tag
0044A0BD 57 push edi ;
0044A0BE 8D7E 04 lea edi,dword ptr ds:[esi+0x4] ;

so I think I need to push the number and give the ecx the ID to test this call
this the code

mov ecx,0F27B1B0 //ID
push 2 //the number
call 0044A0B0 //call

And then I saw there was a little change in the vendor window ,then crashed immediately.

[oraclex]

very appreciate anyone want to help