CrossFire InGameMessagebox External Calling

[awdacwadc]

void InGameMessageBox( HANDLE hProcess, const char* fmt, ... )
{
	const uint8 ingame_msg_shell_code[ ]
	{
		0x48, 0x89, 0x4C, 0x24, 0x08,
		0x48, 0x83, 0xEC, 0x38,
		0x48, 0x8B, 0x44, 0x24, 0x40,
		0x48, 0x83, 0xC0, 0x08,
		0xC7, 0x44, 0x24, 0x28, 0x00, 0x00, 0x00, 0x00,
		0xC7, 0x44, 0x24, 0x20, 0x00, 0x00, 0x00, 0x00,
		0x4C, 0x8B, 0xC8,
		0x45, 0x33, 0xC0,
		0xBA, 0x79, 0x00, 0x00, 0x00,
		0xB9, 0x3A, 0x00, 0x00, 0x00,
		0x48, 0x8B, 0x44, 0x24, 0x40,
		0xFF, 0x10,
		0x48, 0x83, 0xC4, 0x38,
		0xC3
	};


	struct params_t
	{
		void* addr = 0;
		char	string[ 256 ] {};
	};

	const size_t shell_size = sizeof( ingame_msg_shell_code );
	const size_t prams_size = sizeof( params_t );

	params_t params;
	params.addr = (void*)0x00000000000; // E8 ? ? ? ? EB 86 | call    sub_7FFCFA86DA80 <-


	char message[ 256 ] {};
	ZeroMemory( message, sizeof( 256 ) );

	va_list list;
	va_start( list, fmt );
	vsprintf_s( message, 256, fmt, list );
	va_end( list );

	ZeroMemory( params.string, sizeof( message ) );
	StrCpy( params.string, message );

	void* allocPBytes = VirtualAllocEx( hProcess, NULL, shell_size, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE );
	void* allocParams = VirtualAllocEx( hProcess, NULL, prams_size, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE );

	if (allocPBytes && allocParams)
	{
		SIZE_T Size_PBytes = 0;
		SIZE_T Size_Params = 0;

		WriteProcessMemory( hProcess, allocPBytes, ingame_msg_shell_code, shell_size, &Size_PBytes );
		WriteProcessMemory( hProcess, allocParams, &params, prams_size, &Size_Params );

		if (Size_Params == prams_size &&
			Size_PBytes == shell_size)
		{
			HANDLE hThread = CreateRemoteThread( hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)allocPBytes, allocParams, NULL, NULL );
			WaitForSingleObject( hThread, INFINITE );
		}
		else
		{
			MessageBox( NULL, NULL, NULL, NULL );
		}

		VirtualFreeEx( hProcess, allocPBytes, NULL, MEM_RELEASE );
		VirtualFreeEx( hProcess, allocParams, NULL, MEM_RELEASE );
	}
}