VirusTotal / yara

The pattern matching swiss knife
https://virustotal.github.io/yara/
BSD 3-Clause "New" or "Revised" License
7.95k stars 1.42k forks source link

Exception thrown at 0x00007FFBAB876AB4 (user32.dll) While showing loaded modules #2032

Closed HydraDragonAntivirus closed 5 months ago

HydraDragonAntivirus commented 5 months ago

Describe the bug Exception thrown at 0x00007FFBAB876AB4 (user32.dll) in HydraDragonAV.exe: 0xC0000005: Access violation reading location 0x00000003000019E9. It's probably happening due to my code but I can't handle it. Here is the my code https://sourceforge.net/p/hydradragonav/code/ci/master/tree/HydraDragonAV/HydraDragonAV.cpp It happens while loading modules (While loading "pe" module from libyara64.lib probably) To Reproduce Steps to reproduce the behavior: Download my source code then run it happens.

Expected behavior No error and detect EICAR.txt

Screenshots image

Please complete the following information:

Additional context It related with user32.dll https://learn.microsoft.com/en-us/answers/questions/1362136/exception-thrown-at-0x00007ff93feabaf0-(user32-dll Someone got similar problem and solved by changing code. I tried to change the code but still this error happens. My attemps:Changing code according to Microsoft link Result: Failed Reason: Because the are different errors. Not showing import module messageboxes. Result: Failed Reason: Because it's not related with it. The error happens while showing module is imported. Other issues: My code is much slower than python one but still believe C/C++ only way to improve my project. It's too new error to me so if you don't going to answer in 48 hours I probably find a way to fix that then close topic if fixed.

HydraDragonAntivirus commented 5 months ago

Fixed by removing related line now yara rules work well and eicar.txt is matched