C++ WriteProcessMemory makes MessageBox crash the programm

Question

Hello,
i want to write a little AntiHack and i have a problem with one part of it. The idea was to prevent from dll injecting by hooking the LdrLoadDll from NTDLL.DLL. I found a function by googling which do this:
// function call: BlockAPI(m_hProc, "NTDLL.DLL", "LdrLoadDll");
bool zProtect::BlockAPI(HANDLE hProcess, char* libName, char* apiName)
BYTE pRet[]={ 0x31, 0xC0, // XOR eax, eax
0xC3 }; // RET
HINSTANCE hLib = NULL;
VOID *pAddr = NULL;
bool bRet = FALSE;
DWORD dwRet = 0;
hLib = LoadLibrary(libName);
if(hLib)
pAddr = (VOID*)GetProcAddress(hLib, apiName);
if(pAddr)
DWORD dwback;
if(!VirtualProtectEx(hProcess, (LPVOID)pAddr, sizeof(pRet), PAGE_EXECUTE_READWRITE, &dwback))
return false;
if(WriteProcessMemory(hProcess, (LPVOID)pAddr, &pRet, sizeof (pRet), &dwRet))
if(dwRet)
bRet = TRUE;
if(!VirtualProtectEx(hProcess, (LPVOID)pAddr, sizeof(pRet), dwback, &dwback))
return false;
FreeLibrary(hLib);
return bRet;
It's working fine, BUT MessageBox(NULL, msg, "DETECTED", MB_OK); crashes if it is excuted after BlockApi(..);
Exception (first chance)
at 0x75312113
(user32.dll) in
DLLTester.exe: 0xC0000005: Access
violation reading
at position 0x0000002D
Unhandled exception at
0x75312113 (user32.dll)
in DLLTester.exe:
0xC000041D: exception error
during a user
callback
I found out, that before the crash with the MessageBox happen the previous call is the Sleep(1000); from my detecting thread!
Thanks, lolxdfly

Answer 1

@Pavel A
Okay.. I also thought about that. Do you know any solution on how to fix this? I cant make a whitelist for every systemDLL.
@Thomas Roskop
I will translate the error-message
as soon as possible. :)
Which
variable should I look for? There are no variables concerning the msgbox, except msg and msg is a valid CString.
MessageBox(...); // Works
BlockAPI(...); //Block some API (but of course not MsgBox...)
MessageBox(...); // Crash
lolxdfly