在带参数的远程进程中调用函数（注入的DLL）

Question

I've been trying to call a function which resides in an injected DLL using the DLL injector process. The code from this answer works fine with no arguments but passing an argument causes random (non-initialized) gibberish like -1733099520 to be passed to the function instead of the desired DWORD :

DWORD speed_up = 1;
RemoteLibraryFunction(hProcess, targetDll, "set_speedup", &speed_up, sizeof speed_up, &lpReturn);

The DLL function I'm calling is defined as:

#define DLL_EXPORT extern "C" __declspec(dllexport)

DLL_EXPORT void set_speedup(const DWORD new_speed)
{
    sprintf_s(debug_message_buffer, "Setting new speed to: %i\n", new_speed);
    OutputDebugStringA(debug_message_buffer);
    speed = new_speed;
}

Note that I'm using DebugView++ to observe the output of OutputDebugStringA() .

What am I doing wrong? It seems like the parameters are not set/passed correctly but the code seems correct and no functions failed.

Answer 1

It turns out the passed parameter was passed in as address of the DWORD instead of the DWORD . This can be fixed by changing the called function's signature to something like the following:

#define DLL_EXPORT extern "C" __declspec(dllexport)

DLL_EXPORT void set_speedup(const LPVOID acceleration_pointer)
{
    const auto acceleration = *static_cast<DWORD*>(acceleration_pointer);
    speed = acceleration;
}

The calling convention did not matter. Now the call works as expected.