search

abhisek / Pe-Loader-Sample

Proof of concept implementation of in-memory PE Loader based on ReflectiveDLLInjection Technique
148 stars 80 forks source link

Randomly memory allocation failure. #1

Open Advego opened 10 years ago

Advego commented 10 years ago 
if(!pe->pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size) {

EMSG("Failed to map required memory address, need relocation to continue"); EMSG("[WARNING] Forcing re-use of mapped memory");

pe->dwMapBase = (DWORD) pe->pNtHeaders->OptionalHeader.ImageBase;

Because your project have random ImageBase and because of ASLR in Windows 7 and higher, sometimes allocating memory for PE being loaded might be causing intersect with base PE heap address space, and, therefore , loader process failure. This might be avoided by fixing project ImageBase at 0x400000 or reducing default heap size.

Advego commented 10 years ago

*have - has