title: Calling function in unmanaged injected dll
body: <p>I've been trying to solve this problem for days and I still can't get it to work.
  I have successfully injected a unmanaged dll into a remote process. There is a function called testfunction inside of the dll which I'm trying to call through CreateRemoteThread.</p>
  
  <p>I have the address (0x6B610000) for the injected dll within the process and the offset to the function (0x70802) which means the function in the dll is at (0x6B680802).</p>
  
  <p>I have exported the function in the dll as well:</p>
  
  <pre><code>LIBRARY test
  EXPORTS
  testfunction
  </code></pre>
  
  <p>This is how I'm trying to call the function:</p>
  
  <pre><code>    public uint CallFunction()
      {
          IntPtr _functionPtr = IntPtr.Add(this.modulePtr, 0x70802); //this.modulePtr = 0x6B610000
          uint threadID;
          IntPtr hThread = CreateRemoteThread(this.processHandle, IntPtr.Zero, IntPtr.Zero, _functionPtr, IntPtr.Zero, 0, out threadID);
          // wait for thread to exit
          WaitForSingleObject(hThread, 0xFFFFFFFF);
  
          // get the thread exit code
          uint exitCode = 0;
          GetExitCodeThread(hThread, out exitCode);
  
          // close thread handle
          CloseHandle(hThread);
  
          return exitCode;
      }
  </code></pre>
  
  <p>This is my DLL source:</p>
  
  <pre><code>#include "stdafx.h"
  #include &lt;iostream&gt;
  #include &lt;fstream&gt;
  #include &lt;string&gt;
  
  DWORD WINAPI testfunction(LPVOID *param); //&lt;--- the test function im trying to call
  DWORD WINAPI T_HkThread(LPVOID);
  void WriteToLog(std::string _message);
  
  
  void WriteToLog(std::string _message)
  {
      std::ofstream out;
       // std::ios::app is the open mode "append" meaning
       // new data will be written to the end of the file.
       out.open("C:/test/log.txt", std::ios::app);
  
       std::string str = _message + "\n";
       out &lt;&lt; str;
  }
  
  DWORD WINAPI testfunction(LPVOID *param)
  {
      WriteToLog("YES YOU CALLED THE FUNCTION");
      return 0;
  }
  
  
  DWORD WINAPI T_HkThread(LPVOID)
  {
      //Loading CLR INTO PROCESS
      WriteToLog("Thread created...");
      return 0;
  } 
  
  BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
  {
      switch (ul_reason_for_call)
      {
          case DLL_PROCESS_ATTACH:
              {
                  WriteToLog("Injection done: Creating Thread...");
                  CreateThread( NULL, NULL, T_HkThread, NULL, NULL, NULL );
              }
          case DLL_THREAD_ATTACH:
              {
  
              }
          case DLL_THREAD_DETACH:
              {
  
              }
          case DLL_PROCESS_DETACH:
              break;
          }
      return TRUE;
  }
  </code></pre>
  
  <p>The remote application (winamp) in this example loads the dll (i can see the same address in process hacker) but instantly crashes when I try to call the function "testfunction" inside the dll.</p>
  
  <pre><code>winamp caused an Access Violation (0xc0000005) in module winamp.exe at 0023:64bc0802.
  </code></pre>
  
  <p>What am I doing wrong?</p>
  
  <p>Thanks in advance</p>