search

Idov31 / FunctionStomping

Shellcode injection technique. Given as C++ header, standalone Rust program or library.
https://idov31.github.io/2022/01/28/function-stomping.html
GNU General Public License v3.0
684 stars 97 forks source link

[BUG] Failed to change protection [0] #5

Closed ghost closed 2 years ago

ghost commented 2 years ago

Hello, I'm currently studying some codes and I ended up here.

I use windows x64, I had to compile the cpp using the "-DUNICODE" flag to be able to compile, but when I run the console it does not inject any pid and brings this error:

[+] Got process handle! [+] Got function base! [-] Failed to change protection: 0

I tried in notepad and others, in rust when I compile it says that this program is compatible with 32bits and not x64, so the normal "cargo b" instruction doesn't work.

I tried various processes from notepad to others and it doesn't work Screenshot_128 .

Edit: I was able to resolve the architecture error(Windows 10 x64) in rust by running the following commands: rustup target add x86_64-pc-windows-gnu cargo build --target x86_64-pc-windows-gnu

After the test, the calc does not open but in the console everything seems normal, I will continue the tests The message shows the following Screenshot_130 :

Idov31 commented 2 years ago

I'm happy that you managed to compile it (as you already figured the compilation problems has nothing to do with the code I published 😉)

I already addressed the rust problem in the pinned issue, if you find a solution for it - Make a pull request and let me know!

Idov31 commented 2 years ago

After you created the notepad process: You tried to save the file or trigger the CreateFile function?