Help Needed
zCodeAlias opened this issue · comments
I wrote a class (90% copied from yours) that converts asm string code to byte array using Fasm.
I am able to convert the code below when I compile for x86 whereas if I do it for x64 then it throws a null reference exception at certain place in the class, though the code is same and just platform was switched (I can share the class if needed).
Could it be related to the way memory is allocated in the process (which is allocated using VirtualAllocEx)...?
string[] testAsmCode = new string[]
{
"push ebp",
"mov eax, [ebp+8]",
"mov edx, [ebp+12]",
"add eax, edx",
"pop ebp",
"ret"
};
AsmToByteArray(testAsmCode, out byte[] asmBytes);
Any help would be appreciated...
I do think sharing the source (and exception details) here would be advisable. At the very least so the issue could be reproduced.
Technically it's a user error here but I'm down to see if I can pinpoint the issue ;3, curiosity has the best of us.
Thanks a lot! I have attached a reference project (I cut down the extra code so that you can focus on the issue better)..also, the exception is of kind "Null reference" in an unsafe method.
To get the exception, you first run the code using x86 debug config and you will find that it works, then run using x64, it will throw the exception and lead you to the location.
Also, I really appreciate you considering to help me out...all the best!
Yesterday was a busy day so sorry for the late reply.
In either case, chances are your issue is the fact you're not allocating memory in the first 2GB of the process' address space.
As you may or may not know, FASM itself was written in x86 assembly. The x86_64 version isn't a true port of FASM to the new platform (as that would take considerable effort in assembly). Instead, it's more of a wrapper/compatibility shim that still uses the x86 code, just on a new platform; replacing registers via macros etc. where necessary.
As such it's unable to work with memory higher than the first 2GB of virtual memory address space.
Ohhh! I see...just checked and it seems like this is the issue...i will fix it asap. Thanks a lot for the help!
Hello there, I have been trying and was unsuccessful in finding an address that is below 0x7FFFFFFF in 64 bit debug version of the process.
Well, actually I managed to find multiple addresses but i am unable to allocate memory to any of the addresses (Before allocating i filtered out an address at which to allocate by checking that it's state was MEM_FREE and was <= 0x7FFFFFFF)...
and tried to allocated at the address by putting the address in the "lpAddress" arg of the VirtualAllocEx/VirtualAlloc method and tried some variations too but was unsuccessful.
Would it be possible for you to help be here...😅...like a method to allocate at an address which is < 0x7FFFFFFF in 64bit process (as you had suggested in your previous reply) using VirtualAlloc/VirtualAllocEx/Any other way, coded by you 😊.
Or maybe some guide at least? I will be really grateful 🤗.
Thanks for putting in time into this issue, i really appreciate it!
EDIT :
I know i could use Reloaded.Memory.Buffers but i don't wish to due to some personal preferences (I assume you understand 😅).
Also, i was able to get the addresses by referring to the MemoryPages class in Reloaded.Memory.Buffers (basically all copied).
Hello again! The problem is solved now...
I found that at the addresses that were <0x7FFFFFFF in x64 config, VirtualAlloc was allocating memory at an address >0x7FFFFFFF even though the address of the 32 bit range was being passed as "IpAddress"...
Maybe it searches ahead to find it's own addr or maybe it doesn't consider the address being passed, which is not the case because in 32 bit is was considering (not sure)...anyways...
I managed to get the x64 bit config app allocate memory in itself in 32 bit address range by setting the post build event in properties to :
call "$(DevEnvDir)..\tools\vsdevcmd.bat"
editbin /largeaddressaware:no "$(TargetPath)"
...i consider my issue solved here...but if you have something to share or some way to do it without setting this post build event (like you did in your project, i mean without the post build event) then it would be really appreciated...but otherwise also it's fine now.
I will close/ continue with the issue depending on your response :D
Thanks again for your time!