FastMM_GetMem_GetSmallBlock($0000000001d4f7d0)
@GetMem(??)
@NewUnicodeString(16)
@UStrSetLength('',16)
_UInt64ToHexString(140718007382672,16,12,'0','')
IntToHex(??,??,'')
WideFormatBuf($00000080000043c0,4095,$0000000000fd8c34,34,([0]=(((_Reserved1=140718007382672,VType=5)))),(CurrencyString='',CurrencyFormat=0,CurrencyDecimals=0,DateSeparator='-',TimeSeparator=':',ListSeparator=#$0,ShortDateFormat='',LongDateFormat='yyyy-mm-dd',TimeAMString='',TimePMString='',ShortTimeFormat='',LongTimeFormat='hh:nn:ss.zzz',ShortMonthNames=([1]='',[2]='',[3]='',[4]='',[5]='',[6]='',[7]='',[8]='',[9]='',[10]='',[11]='',[12]='')))
FormatBuf(??,??,(??),??,([0]=(((_Reserved1=140718007382672,VType=5)))),(CurrencyString='',CurrencyFormat=0,CurrencyDecimals=0,DateSeparator='-',TimeSeparator=':',ListSeparator=#$0,ShortDateFormat='',LongDateFormat='yyyy-mm-dd',TimeAMString='',TimePMString='',ShortTimeFormat='',LongTimeFormat='hh:nn:ss.zzz',ShortMonthNames=([1]='',[2]='',[3]='',[4]='',[5]='',[6]='',[7]='',[8]='',[9]='',[10]='',[11]='',[12]='')))
FmtStr('','Attempting to uninstall hook at %p',([0]=(((_Reserved1=140718007382672,VType=5))),[1]=(((_Reserved1=0,VType=0))),[2]=(((_Reserved1=16616176,VType=0))),[3]=(((_Reserved1=140718007382016,VType=0))),[4]=(((_Reserved1=549755839664,VType=0))),[5]=(((_Reserved1=140717961651723,VType=14))),[6]=(((_Reserved1=2731615780864,VType=112)))),(CurrencyString='',CurrencyFormat=0,CurrencyDecimals=0,DateSeparator='-',TimeSeparator=':',ListSeparator=#$0,ShortDateFormat='',LongDateFormat='yyyy-mm-dd',TimeAMString='',TimePMString='',ShortTimeFormat='',LongTimeFormat='hh:nn:ss.zzz',ShortMonthNames=([1]='',[2]='',[3]='',[4]='',[5]='',[6]='',[7]='',[8]='',[9]='',[10]='',[11]='',[12]='')))
Format(??,([0]=(((_Reserved1=??,VType=??)))),(CurrencyString='',CurrencyFormat=0,CurrencyDecimals=0,DateSeparator='-',TimeSeparator=':',ListSeparator=#$0,ShortDateFormat='',LongDateFormat='yyyy-mm-dd',TimeAMString='',TimePMString='',ShortTimeFormat='',LongTimeFormat='hh:nn:ss.zzz',ShortMonthNames=([1]='',[2]='',[3]='',[4]='',[5]='',[6]='',[7]='',[8]='',[9]='',[10]='',[11]='',[12]='')),'')
Format(??,([0]=(((_Reserved1=??,VType=??)))),'')
OutputDebugStringFmt('Attempting to uninstall hook at %p',([0]=(((_Reserved1=140718007382672,VType=5)))))
UninstallHook($00007ffb76d7f290,??)
HookedNtQueryVirtualMemory(18446744073709551615,$0000027c25fd0000,MemoryRegionInformation,$00000080000fde18,48,nil)
HookedNtQueryVirtualMemory(18446744073709551615,$0000027c25fd0000,MemoryRegionInformation,$00000080000fde18,48,nil)
function UninstallHook(
const ATargetFunc: Pointer; // Address of the hooked function.
const AOrigBytes: TBytes // The original bytes saved during InstallHook.
): Boolean;
var
LOldProtect: DWORD; // Stores original memory protection flags.
begin
Result := False; // Assume failure.
// Validate input pointer and original bytes length.
if (ATargetFunc = nil) or (Length(AOrigBytes) <> HOOK_SIZE) then
begin
OutputDebugStringFmt('UninstallHook Error: TargetFunc (%p) is nil or OrigBytes length mismatch (%d vs %d).', [ATargetFunc, Length(AOrigBytes), HOOK_SIZE]);
Exit;
end;
OutputDebugStringFmt('Attempting to uninstall hook at %p', [ATargetFunc]);
// 1. Make the target function's memory writable and executable.
if VirtualProtect(ATargetFunc, HOOK_SIZE, PAGE_EXECUTE_READWRITE, LOldProtect) then
try
// 2. Write the saved original bytes back to the target function's entry point.
Move(AOrigBytes[0], ATargetFunc^, HOOK_SIZE);
// 3. Flush the CPU's instruction cache for the modified memory range.
FlushInstructionCache(GetCurrentProcess, ATargetFunc, HOOK_SIZE);
Result := True; // Hook removal successful.
OutputDebugStringFmt('Hook uninstalled successfully at %p', [ATargetFunc]);
finally
// 4. Restore the original memory protection flags.
VirtualProtect(ATargetFunc, HOOK_SIZE, LOldProtect, LOldProtect);
end
else
begin
// VirtualProtect failed. Log error.
OutputDebugStringFmt('UninstallHook Error: VirtualProtect PAGE_EXECUTE_READWRITE failed for %p. Error: %d', [ATargetFunc, GetLastError]);
end;
end;
Best regards.
Hello,
Please note this exception raised by FastMM:
Raised inside:
Best regards.