我使用R3 INLINEHOOK 了gettickcount后,用远程线程的方法注入了war3.exe
没开始游戏时,运行正常 ,而且有加速效果,一开始游戏后,一段时间就出现内存访问错误
.我查看war3的crash记录,发现crash的原因是由于ebx的值被修改,但是我的HOOK函数中
已经对有关寄存器进行保存.
war3的记录
The instruction at '0x00448566' referenced memory at '0x00000005'.
The memory could not be 'read'.
Played Maps\(2)BootyBay.w3m
Player 0 tutbo Race NightElf StartLoc 0
Player 1 鐢佃剳 (绠€鍗曠殑) Race Orc StartLoc 1
Player 2 <Unused> Race Orc StartLoc -1
Player 3 <Unused> Race Orc StartLoc -1
Player 4 <Unused> Race Undead StartLoc -1
Player 5 <Unused> Race Human StartLoc -1
Player 6 <Unused> Race Orc StartLoc -1
Player 7 <Unused> Race Undead StartLoc -1
Player 8 <Unused> Race Undead StartLoc -1
Player 9 <Unused> Race NightElf StartLoc -1
Player 10 <Unused> Race Undead StartLoc -1
Player 11 <Unused> Race Undead StartLoc -1
------------------------------------------------------------------------------
----------------------------------------
x86 Registers
----------------------------------------
EAX=00000000 EBX=00000001 ECX=7C810EB6 EDX=00000007 ESI=014E02D8
EDI=00000102 EBP=0291FF80 ESP=0291FF2C EIP=00448566 ***=00010246
CS =001B DS =0023 ES =0023 SS =0023 FS =003B GS =0000
出错位置的指令:
call [ebx+4]
我用这个程序HOOK自己写的程序时很正常,HOOk有的程序就出错,被这问题折磨几天了
请大家提供点思路....
为了检测HOOK时寄存器的情况,我向HOOK函数加入了下面的3个函数
CreateFile
WriteFile
FlushFileBuffers
打印出当时的寄存器状态
奇迹出现了 游戏居然没出错,只是由于写入操作,游戏延时严重,画面有些卡
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课