[HELP]Detouring Pinball

Well Im practicing simple detours and stuff. Ive had success with Notepad and Minesweeper and I will post a tutorial soon but I have a issue with Pinball.

I successfully inject it, and I know this because I made a MessageBox appear.
I detoured show_high_score_dialog, and it works, because I also made another MessageBox appear. After I close the high score dialog it crashes.

Im using Microsoft Detour 1.2 so yeah...

I also checked the address and its correct.
I also checked function parameters and its all good.
Im using Windows XP SP2

Here is the code:

Code:

#include "windows.h"
#include "detours.h"


#pragma comment(lib,"detours.lib")

void (__stdcall* show_high_score_dialog)(int x);
int myhighscore(int x)
{
	MessageBox(NULL,"Displaying...","Display",MB_OK);
	return show_high_score_dialog(x);
}

BOOL APIENTRY DllMain(HANDLE hModule, DWORD Reason, LPVOID lpReserved)
{
switch (Reason)
{
case DLL_PROCESS_ATTACH:
	MessageBox(NULL,"Injected","Done",MB_OK);
	//CreateThread(NULL,NULL,&highscorechange,NULL,NULL,&ThreadID);
	show_high_score_dialog = (int (__stdcall*)(int))DetourFunction((PBYTE)0x01005412,(PBYTE)myhighscore);
break;
case DLL_THREAD_ATTACH:
break;
case DLL_THREAD_DETACH:
break;
case DLL_PROCESS_DETACH:
	MessageBox(0,"Removed","Done",MB_OK);
break;
}
return TRUE;
}

Originally Posted by aanthonyz

Code:

#include "windows.h"
#include "detours.h"


#pragma comment(lib,"detours.lib")

void (__stdcall* show_high_score_dialog)(int x);
int myhighscore(int x)
{
	MessageBox(NULL,"Displaying...","Display",MB_OK);
	return show_high_score_dialog(x);
}

BOOL APIENTRY DllMain(HANDLE hModule, DWORD Reason, LPVOID lpReserved)
{
switch (Reason)
{
case DLL_PROCESS_ATTACH:
	MessageBox(NULL,"Injected","Done",MB_OK);
	//CreateThread(NULL,NULL,&highscorechange,NULL,NULL,&ThreadID);
	show_high_score_dialog = (int (__stdcall*)(int))DetourFunction((PBYTE)0x01005412,(PBYTE)myhighscore);
break;
case DLL_THREAD_ATTACH:
break;
case DLL_THREAD_DETACH:
break;
case DLL_PROCESS_DETACH:
	MessageBox(0,"Removed","Done",MB_OK);
break;
}
return TRUE;
}

Code:

int __stdcall open_high_score_dialog(int x)

is the actual function signature for this, you need to make sure your detoured function signature matches 100%, i.e:

Code:

int __stdcall myhighscore(int x)

Not doing this will cause the stack to be corrupted, and is most likely the reason you're crashing.

Either that, or you've reversed the function signature incorrectly to begin with.

[Highlight=C++]
void (__stdcall* show_high_score_dialog)(int x);
[/Highlight]

Your function return type is void.

[Highlight=C++]
(int (__stdcall*)(int))DetourFunction..
[/Highlight]

Casting as an integer..

Also, you detoured to your own function, which doesn't use the standard calling convention. Afaik, unless the compiler is told otherwise, the function will be compiled using the __cdecl calling convention.

So far, the function convention is off, the return type is off, and the casting is off. They will most likely all make you crash.

Yup Void pretty much summed it up. Also the in cdecl calling convention the stack is cleaned in the calling function while in stdcall the stack is cleaned in the called function, also causing more errors.

Okie dokie. So I just got completely mind f**ked from Void's explanation but im going to try what you said.

myhighscore should be of type "void" instead of int, and the calling convention is "__stdcall", so add that as well(you've done it correctly in the original function pointer above it)

Also when you've modified that, void functions don't return a value so return show_high_score_dialog(x); is wrong(no need for the return, just call it normally)

Originally Posted by aanthonyz

Code:

#include "windows.h"
#include "detours.h"


#pragma comment(lib,"detours.lib")

void (__stdcall* show_high_score_dialog)(int x);
int myhighscore(int x)
{
	MessageBox(NULL,"Displaying...","Display",MB_OK);
	return show_high_score_dialog(x);
}

BOOL APIENTRY DllMain(HANDLE hModule, DWORD Reason, LPVOID lpReserved)
{
switch (Reason)
{
case DLL_PROCESS_ATTACH:
	MessageBox(NULL,"Injected","Done",MB_OK);
	//CreateThread(NULL,NULL,&highscorechange,NULL,NULL,&ThreadID);
	show_high_score_dialog = (int (__stdcall*)(int))DetourFunction((PBYTE)0x01005412,(PBYTE)myhighscore);
break;
case DLL_THREAD_ATTACH:
break;
case DLL_THREAD_DETACH:
break;
case DLL_PROCESS_DETACH:
	MessageBox(0,"Removed","Done",MB_OK);
break;
}
return TRUE;
}

Bro what are u really trying to do, are u trying to modify ur score while in pinball game
or u just want for ur score to be display or ur screen I am asking a simple question. So please dont start flaming.

If I was u I go with the
int myhighscore;
HWND hWnd = FindWindow(NULL, " Pinball watever.exe")
if(hWnd == NULL)
{
code go write here
}

else
{
code go right here
}

please dont flame say wdf are u talking about i am working with detour
I am just gaving option and also
of course the messagebox function going to work when it inject it will show ur message
but ur code u programmed wont work because of what u did with the void

Originally Posted by bkbatman

Umm, that just gets whether Pinball is open or not, how is that relevant ?

Originally Posted by Jason

Umm, that just gets whether Pinball is open or not, how is that relevant ?

I know it not I am just asking like what is he really trying to do
can explain to me I dont really understand because my mind think different

I know the first code about to tell if pinball open or not then he could write

write to
WriteProcessMemory

it like basic trainner but I didn't fully put the code the. That how I started

modifying my level, score in game and stuff like that. Please dont flame if I am off track

Originally Posted by bkbatman

This is internal memory editing, not external (he's injecting, not running from an external application)

Thanks peoples. Im learning alot actually but I gotta put it on hold because I need to build a robot for a science fair that is mandatory.

[HELP]Detouring Pinball

Post a Reply

Tags for this Thread