I've got a weird problem using CreateRemoteThread... When built in "Release", the dummy codes are copied correctly to remote process and invoked properly, however for "debug" build, some non-sense bytes are copied from a wrong function address..
Codes as below
Code:
#define INJECTSIZE 4096
DWORD __stdcall mySnubber( DWORD c )
{
/*
0 float float float
0xC float float float
0x18 float float float
0x24 float
0x28 float (flag)
0x2C float float float
*/
typedef bool (__cdecl *tTraceLine)(int*, int*, int*, int*, int*, int*);
tTraceLine pTraceLine = (tTraceLine)0x506060;
return pTraceLine((int*)c, (int*)(c+0xC), (int*)(c+0x18), (int*)(c+0x24) ,(int*)(c+0x28) , (int*)0);
}
void testRemoteCall(){
DWORD RmThdId;
LPVOID procAdd, paraAdd;
procAdd = VirtualAllocEx(wowprohnd,NULL, INJECTSIZE, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if(!procAdd){
printf("can't allocate proc Memory\n");
goto cleanup;
}
paraAdd = VirtualAllocEx(wowprohnd,NULL, INJECTSIZE, MEM_COMMIT, PAGE_READWRITE );
if(!paraAdd){
printf("can't allocate parameters Memory\n");
goto cleanup;
}
DWORD szWritten;
if(!WriteProcessMemory(wowprohnd, procAdd, &mySnubber, INJECTSIZE, &szWritten)){
printf("can't write procedure into proc memory\n");
goto cleanup;
}
char testbuff[INJECTSIZE+4];
ReadStr(procAdd, testbuff, INJECTSIZE); // for test
// Setting [in]paraAddress as well , omitted
HANDLE hRmThd = CreateRemoteThread(wowprohnd, NULL, NULL,(DWORD (__stdcall *)( void *))procAdd, paraAdd, NULL, &RmThdId);
if(!hRmThd){
printf("can't create thread \n");
goto cleanup;
}
RmThdId = WaitForSingleObject(hRmThd, 3000);
CloseHandle(hRmThd);
cleanup:
if(procAdd)
if(!VirtualFreeEx(wowprohnd, procAdd, 0, MEM_RELEASE))
printf("Can't free allocated proc memory\n");
if(paraAdd)
if(!VirtualFreeEx(wowprohnd, paraAdd, 0, MEM_RELEASE))
printf("Can't free allocated proc memory\n");
}
This line
Code:
WriteProcessMemory(wowprohnd, procAdd, &mySnubber, INJECTSIZE, &szWritten)
works correctly for "Release" build, but not in "Debug" build. The address for "mySnubber" is wrong... 
Another thing I'm concerning is the WriteProcessMemory.. Is it currently being checked by warden when reading/writing in the newly allocated memory space?