search

Reloaded-Project / Reloaded.Hooks

Advanced native function hooks for x86, x64. Welcome to the next level!
GNU Lesser General Public License v3.0
213 stars 33 forks source link

Failure to allocate during early hook initialization #12

Closed daemitus closed 2 years ago

daemitus commented 2 years ago

A user of mine is having this oddball issue when creating the first hook during our startup sequence. Works mine for plenty of other people, user claims no AV or other such programs.

I don't really expect much in the way of a technical solution here, but do you have any ideas for troubleshooting this and trying to narrow it down? 

System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation.
 ---> System.TypeInitializationException: The type initializer for 'Reloaded.Hooks.Tools.Utilities' threw an exception.
 ---> System.Exception: Unable to find memory location to fit MemoryBuffer of size 65536 (69632) between 1 and 7FFFFFFF.
   at Reloaded.Memory.Buffers.MemoryBufferHelper.Run[T](Int32 retries, Func`1 function)
   at Reloaded.Memory.Buffers.MemoryBufferHelper.Allocate(Int32 size, Int32 minimumAddress, Int32 maximumAddress, Int32 retryCount)
   at Reloaded.Assembler.Assembler.AllocateText(Int32 textSize, Int32 retryCount)
   at Reloaded.Assembler.Assembler..ctor(Int32 textSize, Int32 resultSize)
   at Reloaded.Hooks.Tools.Utilities..cctor()
   --- End of inner exception stack trace ---
   at Reloaded.Hooks.Tools.Utilities.AssembleAbsoluteJump(IntPtr target, Boolean is64bit)
   at Reloaded.Hooks.Hook`1.CreateHook(Int64 functionAddress, Int32 minHookLength)
   at Reloaded.Hooks.Hook`1..ctor(TFunction function, Int64 functionAddress, Int32 minHookLength)
   at Reloaded.Hooks.ReloadedHooks.CreateHook[TFunction](TFunction function, Int64 functionAddress, Int32 minHookLength)
   at the thing where we create a hook.
daemitus commented 2 years ago

So this was probably a kernel level anti-cheat driver in Windows. Thats the theory anyways. Anti cheat by filling up everything through 7FFF_FFFF? Plausible.