APICall results in error #132

[Cromon]

Hello everybody!

Im creating to inject a DLL into wow. Not much to say, i think i just post the code:

typedef HINSTANCE (__stdcall *fpLoadLibrary)(char*);
typedef int (__stdcall *fpMsgBox)(HWND, LPCSTR, LPCSTR, UINT);

struct INJECTSTRUCT
{
      fpLoadLibrary LoadLibrary;
	  fpMsgBox MsgBox;
      char path[255];
};

DWORD WINAPI threadstart(LPVOID addr)
{
	INJECTSTRUCT* is = (INJECTSTRUCT*)addr;
	is->MsgBox(0, is->path, is->path, MB_OK);
	return 0;
}

int main()
{
	HANDLE hProc;
	LPVOID start;
	HINSTANCE hDll;
	INJECTSTRUCT is;

	CMemoryInterface intr;
	hProc = intr.OpenProcess("Wow.exe");
	hDll = LoadLibrary("KERNEL32.dll");
	is.LoadLibrary = (fpLoadLibrary)GetProcAddress(hDll, "LoadLibraryA");
	strcpy(is.path, "C:\\HookDLL.dll");
	hDll = LoadLibrary("USER32.dll");
	is.MsgBox = (fpMsgBox)GetProcAddress(hDll, "MessageBoxA");

	start = VirtualAllocEx(hProc, 0, 0x2000, MEM_COMMIT, PAGE_EXECUTE_READWRITE);

	WriteProcessMemory(hProc, start, (LPVOID)&is, sizeof(INJECTSTRUCT), NULL);
	WriteProcessMemory(hProc, (LPVOID)((DWORD)start + sizeof(INJECTSTRUCT)), threadstart, 0x2000 - sizeof(INJECTSTRUCT), NULL);
	
	HANDLE hThread = CreateRemoteThread(hProc, 0, 0, (LPTHREAD_START_ROUTINE)((DWORD)start + sizeof(INJECTSTRUCT)), (LPVOID)start, 0, 0);
	
	WaitForSingleObject(hThread, INFINITE);
	CloseHandle(hProc);
	printf("Made...\n");
	getchar();
	return 0;
}

Well, what happens? The messagebox appears and displays C:\HookDLL.dll as intended. When i press "ok" on the box i get the following error:

ERROR #132 (0x85100084) Fatal Exception
Program:	C:\Users\Public\Games\World of Warcraft\Wow.exe
Exception:	0x80000003 (BREAKPOINT) at 001B:02AD004F

Im working on that since houres and i cant get it to work. I guess my problem is that i dont have the correct size of the function. But my problem is that i cant figure it out. I made a function threadend just after the end of threadstart but if i subtract threadstart from threadend i get values like 0xEF32BB43.

It would be nice if someone can point me to the right direction.

Greetings
Cromon

[flo8464]

Write your dllpath to memory and start a remote thread on LoadLibrary instead of messing around with that attempt

[Cromon]

Yes, loading the library now works perfectly, but it would be interesting why the above code fails.