Closed hasherezade closed 1 year ago
After the fix parameters were successfully traced:
17710;msvcrt.__iob_func
17610;msvcrt.fflush
15492;kernel32.GetCurrentProcess
d479;kernel32.LoadLibraryA
LoadLibraryA:
Arg[0] = ptr 0x00000000160d25a0 -> "amsi"
d480;kernel32.GetProcAddress
GetProcAddress:
Arg[0] = ptr 0x00007ffd17580000 -> {MZ\x90\x00\x03\x00\x00\x00}
Arg[1] = ptr 0x00000000160d25d0 -> "AmsiScanBuffer"
13ad8;called: ?? [16970000+5c]
> 16970000+6e;SYSCALL:0x50(NtProtectVirtualMemory)
> 16970000+70;nim_sample.[unnamedImageEntryPoint+125ee]*
13b09;called: ?? [16970000+2e]
Test case
Issue
When dumping of the parameters is selected, produced trace is incomplete.
Using the default
params.txt
:The end of the tracelog:
When LoadLibraryA was removed from
params.txt
, the tracelog continues. Example:Possible crash on dumping parameters of LoadLibraryA.