Closed WBGlIl closed 2 years ago
Hi,
what is the issue ?
@xwings There is a problem with the order of the linked list Some shellcodes cannot be run
The first one should be the process itself instead of ntdll
can u please provide the full code so we can test?
@xwings
from qiling import Qiling
file = open("w32-exec-calc-shellcode-esp-func.bin","rb")
X8664_WIN = file.read()
rootfs_x86 = "examples\\rootfs\\x86_windows"
ql = Qiling(code=X8664_WIN, archtype="x86", ostype="windows", rootfs=rootfs_x86)
ql.run()
test shellcode link https://github.com/peterferrie/win-exec-calc-shellcode/blob/master/build/bin/w32-exec-calc-shellcode-esp-func.bin
Close for now.
We updated the codebase for Qiling and Unicorn since this issue being posted.
Feel free to try the latest version.
LDR sequence error InLoadOrderLinks= ntdll, kernel32, ... InMemoryOrderLinks= ntdll,kernel32, ... InInitializationOrderLinks= ntdll, kernel32, ... (no process entry)
The correct order should be InLoadOrderLinks= process, ntdll, kernel32, ... InMemoryOrderLinks= process, ntdll,kernel32, ... InInitializationOrderLinks= ntdll, kernel32, ... (no process entry)
Forgive my bad english