Error while injecting dll into target process 3d analyzer что это

---

---

---

---

---

---

3DAnalyze

#1

Clone Grade Delta

Tech III Pilots

201 сообщений

• EVE Ingame: MagnatDragon
• EVE Alt: WoB Diamond
• Corp: Other Universe Group
• Ally: Solar Sitizens
• Channel: Strategic Channel
• Client: Рус

#2

просто жертва зеленых

EVE-RU Team

17165 сообщений

• EVE Ingame: denadanA
• Ally: RED(offline)
• Client: Eng

Ева — тебя все равно убьют
—
That’s not magic, that was just Pinkie Pie.

#3

Clone Grade Theta

Tech III Pilots

961 сообщений

• EVE Ingame: LLILAKoBLOCK
• EVE Alt: rRAHATKo
• Channel: Кафе «У разбитого тапка»

#4

просто жертва зеленых

EVE-RU Team

17165 сообщений

• EVE Ingame: denadanA
• Ally: RED(offline)
• Client: Eng

Я свою за 500р на авито загнал, на следующий день как разместил объяву

Сообщение отредактировал Denadan: 29 January 2013 — 17:13

Ева — тебя все равно убьют
—
That’s not magic, that was just Pinkie Pie.

#5

Tech III Pilots

786 сообщений

• EVE Ingame: Farkoth
• Corp: [MOLCI]
• Ally:
• Channel: CHILD
• Client: Eng

Разгрузка патронов из сгруппированных орудий в космосе теперь уорректно отобрадает пустые иконки в заде корабляю.

#6

Clone Grade Delta

Tech III Pilots

201 сообщений

• EVE Ingame: MagnatDragon
• EVE Alt: WoB Diamond
• Corp: Other Universe Group
• Ally: Solar Sitizens
• Channel: Strategic Channel
• Client: Рус

Сообщение отредактировал PatronDragon: 30 January 2013 — 19:32

Источник

Помогите «починить» игру . (Ассемблер)

Всем доброго времени суток.
Сразу хочу извиниться за глупую тему, ибо сам не знаю как обозвать пост!
В общем, хочу поделиться своей проблемой со знающими людьми. Был у меня старый компьютер (Intel Celeron 2,53Ghz socket 478; 1,5 Gb DDR PC3200; GeForce MX440 64Mb 128bit) и одна классная игруха (Битва Героев: Кристал Власти от Bloodline), все работало на ура (просто летало); собрал новый комп (AMD Phenom 8750 X3 2,4Ghz; 4Gb DDR2 PC8500; GeForce 8800GT 512Mb и т.д.) установил все с нуля (винду, дрова, софт и игры) и теперь при запуске Битвы Героев (после заставки или нажатия enter) вылетает ошибка:

Очень прошу откликнувшихся о помощи, облазил десятки форумов — всё оказалось без толку! Подскажите люди добрые как исправить данную проблему, о самой проблеме мне известно, что данная игра напрочь отказывается работать с видеокартами класса ВЫШЕ GeForce FX5600 и Radeon 9800. На одном форуме мне посоветовали попробовать дизассемблер, скачал W32Dasm v10, открыл exe`шник игры, нашел строчку :

А что она значит, что с ней делать и как редактировать не знаю (т.к. ассемблер тока начал изучать и пока мало что понимаю в нем). Очень прошу знающих ассемблер людей откликнуться.

Sefiroth
вообще не в ту сторону копаешь, с дизассемблером тут делать нечего. если игрушка старая, запусти её под каким-нибудь эмулятором вроде DosBox, если новая — ищи патч для новых систем. Можешь попытаться поставить режим совместимости со старыми операционками, вдруг поможет?

Remote Debugging по скриншотам — великолепный способ провести время, особенно ночью!

Источник

Error while injecting dll into target process

This forum has migrated to Microsoft Q&A. Visit Microsoft Q&A to post new questions.

Answered by:

Question

I am trying to monitor keystrokes and mouse movements on a target application. I can successfully monitor when the target application starts and stops, and inject a dll into it. I user a timer to monitor idle time. On expiry of the interval, I attempt to launch another process using COM. The target application crashes inside the function to launch the second process. I get a null reference on a structure inside the function, as can be seen from the screen shot. It crashes on line 285, when it tries to use the null structure reference. The null structure reference seems to suggest that perhaps there may something wrong outside the dll, that is, in the injecting process.

The process exits with 0xdeadc0de

The sequence of operations is as follows

Windows Service ->Launches ProcessMonitor-X86 [this C# app monitors start and stop of target process]->Instantiates an out of process COM server (C++) ProcessMonitorX86 when the the target process starts->ProcessMonitorX86 finds the window of the target process and injects a dll Hook_X86.dll into the process. This dll monitors keystrokes and mouse movements.

I am injecting the dll into a process using shared sections, as follows

#pragma comment(linker, «/SECTION:.shared,RWS»)
#pragma data_seg(«.shared»)
HHOOK hhKeyboard, hhMouse;
__int64 nIdleTime=0;
#pragma data_seg()

The Timer proc is as follows

he LaunchCacheLoaderAppEx function is as follows

Answers

There is a threading model being used by the C# COM Server although you may not have specified it.

There is obviously some problem with the in-process C# COM Server that is manifesting when you try to instantiate a COM object from the injected DLL. Do you need to use managed code for the in-process COM server?

Using an out-of-process server would provide greater isolation at the cost of lesser performance.

I am trying to monitor keystrokes and mouse movements on a target application. I can successfully monitor when the target application starts and stops, and inject a dll into it. I user a timer to monitor idle time. On expiry of the interval, I attempt to launch another process using COM. The target application crashes inside the function to launch the second process. I get a null reference on a structure inside the function, as can be seen from the screen shot. It crashes on line 285, when it tries to use the null structure reference. The null structure reference seems to suggest that perhaps there may something wrong outside the dll, that is, in the injecting process.

The process exits with 0xdeadc0de

The sequence of operations is as follows

Windows Service ->Launches ProcessMonitor-X86 [this C# app monitors start and stop of target process]->Instantiates an out of process COM server (C++) ProcessMonitorX86 when the the target process starts->ProcessMonitorX86 finds the window of the target process and injects a dll Hook_X86.dll into the process. This dll monitors keystrokes and mouse movements.

I am injecting the dll into a process using shared sections, as follows

#pragma comment(linker, «/SECTION:.shared,RWS»)
#pragma data_seg(«.shared»)
HHOOK hhKeyboard, hhMouse;
__int64 nIdleTime=0;
#pragma data_seg()

The Timer proc is as follows

he LaunchCacheLoaderAppEx function is as follows

A couple of observations —

1) On what thread is LaunchCacheLoaderEx being called? Did you create the thread?

2) The code does not check the return from CoInitialize(). Maybe it failed because COM had already been initialized by the target process.

3) You misunderstand ATL’s CComPtr smart pointer class. The class will initialize the encapsulated interface pointer to NULL when the ptr object is constructed. That is what you are seeing in the debugger as shown in the posted image. At a later point, if the CoCreateInstance member function is successful, the encapsulated interface pointer will not be NULL. So the NULL value displayed in the debugger prior to the call to CoCreateInstance is normal.

4) The switch statements that evaluate HRESULT return codes only evaluate certain error codes and call MessageBox while allowing processing to continue. So any error will cause the use of an uninitialized pointer later in the code that will likely cause process termination. Also, the switch statements ignore all other possible COM errors while allow processing to silently continue. This will also result in the use of uninitialized pointers.

5) The code calls CoUninitialize() before the CComPtr ptr objects destructor has run to release the encapsulated interface. This is also a problem.

Thanks for the reply RLWA32

I forgot to mention one thing, this code was working fine previously, but somehow its creating problems on my pc. I checked on another PC expecting the same problem [the target process crashing], but that did not happen. It works ok.

1) On what thread is LaunchCacheLoaderEx being called? Did you create the thread? The Timer proc calls it. I havent created any separate threads

2). I thought that CoInitialize was per thread,not per-process, so each thread would have to call it.

3) Thanks for the clarification. I thought a structure was getting shown as a NULL, which I thought was impossible

5) Please let me know how to fix this issue, too.

1) On what thread is LaunchCacheLoaderEx being called? Did you create the thread? The Timer proc calls it. I havent created any separate threads

2). I thought that CoInitialize was per thread,not per-process, so each thread would have to call it.

Yes, COM is initialized per-thread. The reason I asked is because if you didn’t create the thread you are using then you don’t know if COM has already been initialized on that thread. That’s why it is important to check the return code from CoInitialize. Also, be aware of the implicit MTA; see https://devblogs.microsoft.com/oldnewthing/20130419-00/?p=4613

We have no information about the manner in which your Timer proc function is invoked.

You should certainly change the code to make sure that CoInitialize succeeds and include error handling if it does not. You should also change the code to avoid using uninitialized pointers.

5) Please let me know how to fix this issue, too.

The CComPtr object should be declared in a statement block so that it goes out of scope and its destructor is called before the call to CoUninitialize.

Thanks a lot for the reply, RLWA32

I will verify that there are no problems on other PCs, before closing this issue, because I am still worried that the problem will show up on another PC.

Surely you meant to say

HRESULT hr = ptr.CoCreateInstance( &clsid, NULL, CLSCTX_ALL );

That string is not a CLSID.

Tim Roberts | Driver MVP Emeritus | Providenza & Boekelheide, Inc.

Surely you meant to say

HRESULT hr = ptr.CoCreateInstance( &clsid, NULL, CLSCTX_ALL );

That string is not a CLSID.

Tim Roberts | Driver MVP Emeritus | Providenza & Boekelheide, Inc.

I am injecting the dll into a process using shared sections, as follows

#pragma comment(linker, «/SECTION:.shared,RWS»)
#pragma data_seg(«.shared»)
HHOOK hhKeyboard, hhMouse;
__int64 nIdleTime=0;
#pragma data_seg()

Note that according to samples, all of the shared variables must be initialised. Therefore, write HHOOK hhKeyboard = 0, etc.

Mark the replies if you think it helps you solve the issue and to click «Unmark as Answer» if not. This can be beneficial to other community members reading this thread. Thanks for your cooperation.

MSDN Community Support
Please remember to click «Mark as Answer» the responses that resolved your issue, and to click «Unmark as Answer» if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.

The problem appears on other PCs too. I have some clue because Fusion Log Viewer reports two C# dlls are not getting loaded by the CC++ app. Could this be the reason for the crash? [The screenshots below show the files which are not loaded by the program tally.exe [SocketCommunicationLibraryX64.dll and CommonSocketCommunicationLibraryX64.dll]

Also, I tried using CoCreateInstance API directly instead of CComPtr, and even enclosed it in a __try / __except block, but it still crashes suddenly. At the time of crash, the output window shows the following

The thread 0x1a80 has exited with code 0 (0x0).
tally.exe has triggered a breakpoint.

‘tally.exe’ (Win32): Loaded ‘C:WindowsSystem32clbcatq.dll’.
‘tally.exe’ (Win32): Loaded ‘C:WindowsSystem32mscoree.dll’.
‘tally.exe’ (Win32): Loaded ‘C:WindowsMicrosoft.NETFramework64v4.0.30319mscoreei.dll’.
‘tally.exe’ (Win32): Loaded ‘C:WindowsSystem32sxs.dll’.
‘tally.exe’ (Win32): Loaded ‘C:WindowsMicrosoft.NETFramework64v4.0.30319clr.dll’.
‘tally.exe’ (Win32): Loaded ‘C:WindowsSystem32vcruntime140_clr0400.dll’.
‘tally.exe’ (Win32): Loaded ‘C:WindowsSystem32ucrtbase_clr0400.dll’.
Exception thrown at 0x00007FFB2D91A839 (KernelBase.dll) in tally.exe: 0x04242420 (parameters: 0x0000000031415927, 0x00007FFAF2670000, 0x000000900ECFC2A0).
The thread 0xd2c has exited with code -559038242 (0xdeadc0de).
The thread 0x2938 has exited with code -559038242 (0xdeadc0de).
The thread 0x2550 has exited with code -559038242 (0xdeadc0de).
The thread 0xe4c has exited with code -559038242 (0xdeadc0de).
The thread 0x2954 has exited with code -559038242 (0xdeadc0de).
The thread 0x2754 has exited with code -559038242 (0xdeadc0de).
The thread 0x226c has exited with code -559038242 (0xdeadc0de).
The thread 0x3188 has exited with code -559038242 (0xdeadc0de).
The thread 0x1dd8 has exited with code -559038242 (0xdeadc0de).
The thread 0x245c has exited with code -559038242 (0xdeadc0de).
The thread 0x2c2c has exited with code -559038242 (0xdeadc0de).
The thread 0x19c8 has exited with code -559038242 (0xdeadc0de).
The thread 0x316c has exited with code -559038242 (0xdeadc0de).
The thread 0x13f0 has exited with code -559038242 (0xdeadc0de).
Exception thrown at 0x00007FFB000F552C (mscoreei.dll) in tally.exe: 0xC0000005: Access violation reading location 0xFFFFFFFFFFFFFFFF.

Could it be that tally.exe tries to load the dlls, and then is unable to load them and so crashes?

What does DEADCODE mean? (0xdeadc0de).

The method in which the crash occurs is as follows

I have followed your suggestion to check the return value of CoInitialize, and also put the CComPtr in a separate block so that it falls out of scope before CoUnintialize is called.

My understanding was that your problem occurred when you tried to instantiate an out-of-process COM server from a Dll that was injected into a target process and the code you posted was used by that injected DLL.

I don’t have any understanding of how the posted code (which appears to be unmanaged C++) is related to the errors that were just posted, nor do I understand where tally.exe and the two C# DLLs fit into the scenario you previously described.

If one of your C# DLLs host the COM server then they would be in-process, not out-of -process.

So is the COM Server the implements ISocketClient written in managed code?

Assuming the answer is yes, do you have these problems if your injected dll tries to instantiate an in-process COM server written in unmanaged C++?

yes, the COM Server implements ISocketClient written in C#

I will need to check that, by creating an unmanaged server project. Should I? Or perhaps, you can suggest which class I can try to instantiate, so that I dont have to create another ATL project.

I tried an ATL in-process Server, and it works ok [I instantiated it and called a method which showed a messagebox]

. Should I also try with an Out of process server?

Do you want to use an in-process or out-of-process server in your actual project? Whichever you have chosen that is how I think you should test.

You might consider creating a minimal managed in-process COM server with C# and try testing with that also. If you can do that successfully, then that would point to the specific C# DLLs you mentioned earlier as being the culprits.

There is a sample C# DLL COM server available at https://code.msdn.microsoft.com/windowsdesktop/CSDllCOMServer-1d5f97a4 if you want to try testing with it.

Its an in process server, so I guess that should be good enough. I will try instantiating another minimal managed in process server and post the results

Do you want to use an in-process or out-of-process server in your actual project? Whichever you have chosen that is how I think you should test.

You might consider creating a minimal managed in-process COM server with C# and try testing with that also. If you can do that successfully, then that would point to the specific C# DLLs you mentioned earlier as being the culprits.

There is a sample C# DLL COM server available at https://code.msdn.microsoft.com/windowsdesktop/CSDllCOMServer-1d5f97a4 if you want to try testing with it.

Thanks! A minimal managed in process COM server works ok. So the specific dlls are the problem. How do I proceed further?

I havent specified a threading model. The dot net framework used in all dlls is 4.6.1. The interface methods I use are above.

How do your other C# DLL COM servers differ from the sample?

Threading model? Interface methods and types of parameters passed? Versions of the .Net Framework used? And so forth.

The following code works too, in a console app, and that is what I am trying to do in the injected DLL.

I added a reference to SocketCommunicationLibraryX86, so that I could cast the dynamic to a specific interface.

But the instantiation is through CreateInstance

I havent specified a threading model. The dot net framework used in all dlls is 4.6.1. The interface methods I use are above.

There is a threading model being used by the C# COM Server although you may not have specified it.

There is obviously some problem with the in-process C# COM Server that is manifesting when you try to instantiate a COM object from the injected DLL. Do you need to use managed code for the in-process COM server?

Using an out-of-process server would provide greater isolation at the cost of lesser performance.

I guess performance is not such a critical issue in this case. I will try an out of server implementation and post the results

I tried an out of process implementation. It worked when I copied the dlls to the target app folder [tally.exe folder in program files]. The reason seems to be that the files are being searched for in the target applications folder, instead of the installation path.

The following is output from fuslogvw.

The operation failed.
Bind result: hr = 0x80070002. The system cannot find the file specified.

Assembly manager loaded from: C:WindowsMicrosoft.NETFramework64v4.0.30319clr.dll
Running under executable C:Program FilesTallyTally.ERP9tally.exe
— A detailed error log follows.

=== Pre-bind state information ===
LOG: DisplayName = SocketCommunicationLibraryX64, Version=1.0.0.1, Culture=neutral, PublicKeyToken=ddd12b78ed5ab5f6
(Fully-specified)
LOG: Appbase = file:///C:/Program Files/Tally/Tally.ERP9/
LOG: Initial PrivatePath = NULL
LOG: Dynamic Base = NULL
LOG: Cache Base = NULL
LOG: AppName = tally.exe
Calling assembly : (Unknown).
===
LOG: This bind starts in default load context.
LOG: Download of application configuration file was attempted from file:///C:/Program Files/Tally/Tally.ERP9/tally.exe.config.
LOG: Configuration file C:Program FilesTallyTally.ERP9tally.exe.config does not exist.
LOG: No application configuration file found.
LOG: Using host configuration file:
LOG: Using machine configuration file from C:WindowsMicrosoft.NETFramework64v4.0.30319configmachine.config.
LOG: Post-policy reference: SocketCommunicationLibraryX64, Version=1.0.0.1, Culture=neutral, PublicKeyToken=ddd12b78ed5ab5f6
LOG: GAC Lookup was unsuccessful.
LOG: Attempting download of new URL file:///C:/Program Files/Tally/Tally.ERP9/SocketCommunicationLibraryX64.DLL.
LOG: Attempting download of new URL file:///C:/Program Files/Tally/Tally.ERP9/SocketCommunicationLibraryX64/SocketCommunicationLibraryX64.DLL.
LOG: Attempting download of new URL file:///C:/Program Files/Tally/Tally.ERP9/SocketCommunicationLibraryX64.EXE.
LOG: Attempting download of new URL file:///C:/Program Files/Tally/Tally.ERP9/SocketCommunicationLibraryX64/SocketCommunicationLibraryX64.EXE.
LOG: All probing URLs attempted and failed.

*** Assembly Binder Log Entry (28-08-2019 @ 11:33:48) ***

The operation failed.
Bind result: hr = 0x80070002. The system cannot find the file specified.

Источник

b_d 4 / 2 / 1 Регистрация: 27.01.2014 Сообщений: 114
	1
10.04.2016, 00:27. Показов 3747. Ответов 0 Метки нет (Все метки) Выдаёт ошибку при попытке запуска через него любого приложения: «error while injecting dll into target process». Обтыкался галочками там уже, ничего не помогает, кто нибудудь сталкивался? __________________ Помощь в написании контрольных, курсовых и дипломных работ, диссертаций здесь 0

Unanswered topics Active topics

Who is online

Users browsing this forum: No registered users and 0 guests

[phpBB Debug] PHP Warning: in file [ROOT]/vendor/twig/twig/lib/Twig/Extension/Core.php on line 1275: count(): Parameter must be an array or an object that implements Countable

You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot post attachments in this forum