search

Idov31 / FunctionStomping

Shellcode injection technique. Given as C++ header, standalone Rust program or library.
https://idov31.github.io/2022/01/28/function-stomping.html
GNU General Public License v3.0
684 stars 97 forks source link

Notepad.exe throwing Unhandled Exception: System.AccessViolationException #8

Closed federico22285 closed 1 year ago

federico22285 commented 1 year ago

Hello @Idov31

Many thanks for your previous advice as those allowed me to make some little progress. I have tried the C++ code as well and I am facing the following challenge. Even when I am trying to put a breakpoint to debug the code. I have tried with the POC shellcode to spawn Calc and generated other examples with reverse shells in case that was the issue. Tested with the classic Windows calculator.

Many thanks, Kind regards, Federico

Microsoft Windows [Version 10.0.19045.3086]

C:\Users\federico\source\repos\test\x64\Release>test.exe [+] Got process handle! [+] Got function base! [+] Changed protection to RW to write the shellcode. [+] Successfuly stomped the function! [+] Changed protection to WCX to run the shellcode! [+] Shellcode successfuly injected!

Unhandled Exception: System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt. at FunctionStomping(UInt32 pid) in C:\Users\federico\source\repos\test\functionstomping.hpp:line 41 at mainCRTStartup()

federico22285 commented 1 year ago

@Idov31 drop me a hint :-) show me some light, lol

Idov31 commented 1 year ago

Please refer to issue #4 .