search

microsoft / Detours

Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed in source code form.
MIT License
5.18k stars 1k forks source link

<BUG>crash on jmp addr? #309

Open swordno opened 10 months ago

swordno commented 10 months ago

I encountered an application crash during the injection process while using the Detours library. The crash occurs consistently, and I am unable to proceed with my use case. I would appreciate any guidance or help in resolving this issue.

To Reproduce Steps to reproduce the behavior:

Set up the Detours library according to the documentation Attempt to inject a DLL into a target process Observe the crash during the injection process Expected behavior I expected the injection process to complete successfully without any crashes or errors, allowing me to proceed with my use case.

OS: Windows 10 Compiler: Visual Studio 2010 Version of Detours library: both 4.0.1 and master image crash dmp & pdb test.zip

kweatherman commented 7 months ago

Debug it. Put a break point on your hook function and on the hook target. Or put a DebugBreak(); at the top of your hook function .

Run your project in VisualStudio, or if you can't setup your HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ for your target executable so your debugger attaches automatically. Web search on how to do this.

Right after you apply your hook, point your disassembly view to the hook address. Does it look right?

Also why are you applying a JMP5 hook yourself. Why not use Detours DetourAttach or something and let it do the hooking?

Anyhow my questions are really rhetorical (ones you need to answer for yourself first). you need to figure out what is going on in your code and how you do that is to step through it with a debugger.