windows - 快速调用函数崩溃

Question

尝试使用我的程序中的 fastcall 约定调用进程函数，但每次尝试时都会崩溃。花了这么多时间，无法解决这个问题......需要一些帮助......
这是所有需要的信息和我的尝试:



图为函数的程序运行时断点后的指令上下文...

这是我的代码源:

typedef void (__fastcall * MyFoo)(void * client,DWORD trash, DWORD ConstantD, DWORD objBattid, DWORD zeroParam, DWORD thousParam, float fVal,DWORD targetID);
MyFoo launchMe;

DWORD getProcessBaseAdress(DWORD ProcessID);

char *flyffServer = "insanity flyff\0";

HWND neuzWindow = NULL;
DWORD neuzProcessID = NULL;
DWORD neuzRamAdress = NULL;
HANDLE neuzHandle = NULL;
DWORD clientAdr = NULL;

int main(){
neuzWindow = FindWindowA(0,flyffServer);
//--------------------------------------
if(neuzWindow){
    GetWindowThreadProcessId(neuzWindow,&neuzProcessID);

    if(neuzProcessID){
        neuzHandle = OpenProcess(PROCESS_ALL_ACCESS,false,neuzProcessID);

        if(neuzHandle){
            neuzRamAdress = getProcessBaseAdress(neuzProcessID); // Extracting Neuz's base address

            if(neuzRamAdress){
                launchMe = (MyFoo)((DWORD)neuzRamAdress + 0x5C400);
                clientAdr = (DWORD)neuzRamAdress + 0x8D0DC0;

                printf("Instruction: 0x%08X\n",launchMe);
                printf("Client ADR: 0x%08X\n",clientAdr);

                for(;;Sleep(100)){
                    //------------ init params ------------
                    void * client = (void*)clientAdr;
                    DWORD trashDX = (DWORD)0x0000000B;
                    DWORD msge = (DWORD)0x0000001D;
                    DWORD selectedBattID = 0x04D4A929;
                    DWORD zeroParam = (DWORD) 0x00000000;
                    DWORD milleParam = 0x00010000;
                    float speedAtt = 0.07f;
                    DWORD targetID = 0x0089B964;

                    printf("0x%08X\n0x%08X\n0x%08X\n0x%08X\n0x%08X\n0x%08X\n%f\n0x%08X\n",
                        client,
                        trashDX,
                        msge,
                        selectedBattID,
                        zeroParam,
                        thousParam,
                        speedAtt,
                        targetID
                    );

                        launchMe(client,trashDX,msge,selectedBattID,zeroParam,milleParam,speedAtt,targetID); // -> Error 
                        scanf("%d",&trashDX); // for blocking the program
                        return 0;
                }
            }
            else printf("Unable to access to Neuz's Ram Adress\n");
        }
        else printf("Unable to obtain neuz's handle\n");
    }
    else printf("Unable to detect neuz's process ID\n");
}
else printf("Unable to detect neuz's window\n");
return 0;
}

DWORD getProcessBaseAdress(DWORD ProcessID){
    HANDLE hModuleSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, ProcessID);
    MODULEENTRY32 me32;
    me32.dwSize = sizeof(MODULEENTRY32);
    Module32First(hModuleSnap,&me32);
    return (DWORD) me32.modBaseAddr;
}

提前致谢 :) ...

Answer 1

正如 IInspectable 在他的评论中所说，问题来自访问另一个进程的虚拟空间。
检查 Windows 内存管理和 DLL 注入(inject)已经为我解决了这个问题……也许将来有人会面临这个问题。