title: Injected dll crashes the owner process. Why?
body: <p>I have a dll that I injected in a process. It searches 'file://' until it finds invalid symbol. After a few mins it crashes the main process. Why is that? How can I check? I found that with smaller stack size on CreateThread it crashes faster, so it can be somehow stack overflow, but I'm not allocating nothing, but a single struct.</p>
  
  <pre><code>BOOL APIENTRY DllMain(HINSTANCE hInstDLL, DWORD fdwReason, LPVOID lpvReserved)
  {
      switch (fdwReason)
      {
          case DLL_PROCESS_ATTACH:
  
          CreateThread(NULL, 500, SampleFunction, 0, 0, NULL);            
              break;
  
          case DLL_THREAD_ATTACH:
  
              break;
  
          case DLL_THREAD_DETACH:
              break;
  
          case DLL_PROCESS_DETACH:
              break;
      }
  
      /* Return success */
      return TRUE;
  }
  
  
  
  int Send(char* strDataToSend) {
      HWND hWnd = FindWindow(NULL, "Test");
      if (hWnd) {
          COPYDATASTRUCT cpd;
          cpd.dwData = 0;
          cpd.cbData = (strlen(strDataToSend) + 1) * 2;
          cpd.lpData = (PVOID)strDataToSend;
          SendMessage(hWnd, WM_COPYDATA, (WPARAM) hWnd, (LPARAM)&amp;cpd);
      }
  }
  
  int isurl(char c) {
      char* chars = "-._~:/?#[]@!$&amp;'()*+,;=%";
      for(int i = 0; i &lt; strlen(chars); i++) {
          if (chars[i] == c || isalnum(c)) {
              return 1;
          }           
      }
  
      return 0;
  }
  
  TESTDLLMAPI void WINAPI SampleFunction(void) {
      MessageBox(0,"LOADED !",0,0);
      MEMORY_BASIC_INFORMATION info;  
      MEMORY_BASIC_INFORMATION* pinfo = &amp;info;
  
      while(1) {
  
  
      int cnt = 0;
      unsigned long addr = 0;
      do {
          ZeroMemory(&amp;info, sizeof(info));
  
          if (!VirtualQueryEx(GetCurrentProcess(), (LPCVOID) addr, pinfo, sizeof(info))) {
              //MessageBox(0,"FAILED",0,0);
          }       
  
              if (info.State == 0x1000) {
              if (info.Protect == PAGE_READONLY || info.Protect == PAGE_READWRITE) {
                  __try {
  
                  if (info.RegionSize &lt; 128) continue;
  
                  for(long i = 0; i &lt; info.RegionSize - 10; i+=7) {
  
                  char* buff = info.BaseAddress;
                      if (buff[i] == 'f' &amp;&amp; buff[i+1] == 'i' &amp;&amp; buff[i+2] == 'l' &amp;&amp; buff[i+3] == 'e' &amp;&amp; buff[i+4] == ':' &amp;&amp; buff[i+5] == '/' &amp;&amp; buff[i+6] == '/') {
  
                          long start = i;
                          long end   = start+7;
  
                          while(end &lt; info.RegionSize - 10 &amp;&amp; isurl(buff[end])) end++; 
  
                          int len = end - start + 1;
                          char* test = (char*) calloc(len, 1);
                          //memcpy(test, buff+start, len);
                          int k = 0;
                          for (int j = start; j &lt;= end; j++, k++) {
                              test[k] = buff[j];
                          }
  
  
                              Send(test);
                                                      free(test); 
                              cnt++;      
                          }
  
                      }
                  } __finally {}
              }
          }
  
          addr = (unsigned long) info.BaseAddress + (unsigned long) info.RegionSize;
      } while (addr != 0 &amp;&amp; addr &lt; 0x7FFF0000);
  
      Sleep(1000);
  
  }
  </code></pre>