Problems with WoW's PrintChat function

[MartyT]

Hey there,

I have problems with my little test app. I inject a dll into the process that calls WoW's printchat function and sometimes it randomly crashes. I have no idea why, but it is inside the PrintChat function. I'd be glad if someone could point me if I missed anything.

typedef VOID (__cdecl *fnPrintChat) (CHAR* szMsg, DWORD _1, DWORD _2, DWORD _3, DWORD _4, DWORD _5, CHAR* szAuthor, DWORD _6, DWORD _7, DWORD _8, DWORD _9, DWORD _10, DWORD _11);

fnPrintChat fpPrintChat = (fnPrintChat*)GetDllOffset("WoW.exe", 0x952C0);

for(INT i = 0; i < 50; i++)
{
	fpPrintChat("hi thar!", NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL);
	Sleep(500);
}

Thanks!

[Cypher]

I hear that crash dumps often help diagnose crashes.

Then again maybe I'm just retarded...

[MartyT]

I hear that crash dumps often help diagnose crashes.

Then again maybe I'm just retarded...

I don't think they'll be that useful since it crashes at random addresses.

This application has encountered a critical error:

ERROR #132 (0x85100084) Fatal Exception
Program: D:\Games\World of Warcraft\Wow.exe
Exception: 0xC0000029 (unknown exception) at 001B:7C95EB28

This application has encountered a critical error:

ERROR #132 (0x85100084) Fatal Exception
Program: D:\Games\World of Warcraft\Wow.exe
Exception: 0xC0000005 (ACCESS_VIOLATION) at 001B:0040BE5A

The instruction at "0x0040BE5A" referenced memory at "0x04267000".
The memory could not be "written".


ERROR #132 (0x85100084) Fatal Exception
Program: D:\Games\World of Warcraft\Wow.exe
Exception: 0xC0000005 (ACCESS_VIOLATION) at 001B:0072A9C4

The instruction at "0x0072A9C4" referenced memory at "0x13B6B900".
The memory could not be "written".


This application has encountered a critical error:

ERROR #132 (0x85100084) Fatal Exception
Program: D:\Games\World of Warcraft\Wow.exe
Exception: 0x80000004 (SINGLE_STEP) at 001B:05321749


This application has encountered a critical error:

ERROR #132 (0x85100084) Fatal Exception
Program: D:\Games\World of Warcraft\Wow.exe
Exception: 0xC0000005 (ACCESS_VIOLATION) at 001B:007BBC27

The instruction at "0x007BBC27" referenced memory at "0x6E695F77".
The memory could not be "read".

I fail at understanding why it crashes when calling the function. As I mention above, it randomly crashes, sometimes it crashes at the 3rd call, and sometimes at the first.

Thanks

[kynox]

Then again maybe I'm just retarded...

About fkn time.

[Cypher]

About fkn time.

Sarcasm

Pronunciation (IPA): /ˈsɑːkæzəm/

Noun - sarcasm (plural sarcasms):
A form of humor that is marked by mocking with irony, sometimes conveyed in speech with vocal over-emphasis. Saying something that is opposite of what is intended to be meant.

Kynox

Pronunciation (IPA): /ˈriːtɑː(ɹ)d/

Noun - retard (plural retards, singular synonym kynox):
1. (offensive slang) a person with mental retardation
2. (offensive slang) a stupid person, or one who is slow to learn

[hypnodok]

Hey there,

I have problems with my little test app. I inject a dll into the process that calls WoW's printchat function and sometimes it randomly crashes. I have no idea why, but it is inside the PrintChat function. I'd be glad if someone could point me if I missed anything.

typedef VOID (__cdecl *fnPrintChat) (CHAR* szMsg, DWORD _1, DWORD _2, DWORD _3, DWORD _4, DWORD _5, CHAR* szAuthor, DWORD _6, DWORD _7, DWORD _8, DWORD _9, DWORD _10, DWORD _11);

fnPrintChat fpPrintChat = (fnPrintChat*)GetDllOffset("WoW.exe", 0x952C0);

for(INT i = 0; i < 50; i++)
{
    fpPrintChat("hi thar!", NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL);
    Sleep(500);
}

Thanks!

Have you tried calling this from wows main thread?

[lanman92]

Don't you think it would crash EVERY time if it was a TLS issue? He said it crashes sparingly at random addresses.

[Cypher]

Don't you think it would crash EVERY time if it was a TLS issue? He said it crashes sparingly at random addresses.

Threading does cause some pretty wonky issues, even with the correct TLS pointer.

[MartyT]

Threading does cause some pretty wonky issues, even with the correct TLS pointer.

Yeah, you're right. I figured out what is wrong, sometimes it tries to read stuff from the Thread Local Storage. I detour WoW's GetTLSValue function and feed it with the correct pointer incase the function returns 0.

Thanks for your guys help, I don't think I'd have thought about the TLS ..

[hypnodok]

Would you mind sharing your code with us?