Code:void InGameMessageBox( HANDLE hProcess, const char* fmt, ... ) { const uint8 ingame_msg_shell_code[ ] { 0x48, 0x89, 0x4C, 0x24, 0x08, 0x48, 0x83, 0xEC, 0x38, 0x48, 0x8B, 0x44, 0x24, 0x40, 0x48, 0x83, 0xC0, 0x08, 0xC7, 0x44, 0x24, 0x28, 0x00, 0x00, 0x00, 0x00, 0xC7, 0x44, 0x24, 0x20, 0x00, 0x00, 0x00, 0x00, 0x4C, 0x8B, 0xC8, 0x45, 0x33, 0xC0, 0xBA, 0x79, 0x00, 0x00, 0x00, 0xB9, 0x3A, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x40, 0xFF, 0x10, 0x48, 0x83, 0xC4, 0x38, 0xC3 }; struct params_t { void* addr = 0; char string[ 256 ] {}; }; const size_t shell_size = sizeof( ingame_msg_shell_code ); const size_t prams_size = sizeof( params_t ); params_t params; params.addr = (void*)0x00000000000; // E8 ? ? ? ? EB 86 | call sub_7FFCFA86DA80 <- char message[ 256 ] {}; ZeroMemory( message, sizeof( 256 ) ); va_list list; va_start( list, fmt ); vsprintf_s( message, 256, fmt, list ); va_end( list ); ZeroMemory( params.string, sizeof( message ) ); StrCpy( params.string, message ); void* allocPBytes = VirtualAllocEx( hProcess, NULL, shell_size, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE ); void* allocParams = VirtualAllocEx( hProcess, NULL, prams_size, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE ); if (allocPBytes && allocParams) { SIZE_T Size_PBytes = 0; SIZE_T Size_Params = 0; WriteProcessMemory( hProcess, allocPBytes, ingame_msg_shell_code, shell_size, &Size_PBytes ); WriteProcessMemory( hProcess, allocParams, ¶ms, prams_size, &Size_Params ); if (Size_Params == prams_size && Size_PBytes == shell_size) { HANDLE hThread = CreateRemoteThread( hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)allocPBytes, allocParams, NULL, NULL ); WaitForSingleObject( hThread, INFINITE ); } else { MessageBox( NULL, NULL, NULL, NULL ); } VirtualFreeEx( hProcess, allocPBytes, NULL, MEM_RELEASE ); VirtualFreeEx( hProcess, allocParams, NULL, MEM_RELEASE ); } }