hasherezade / masm_shc

A helper utility for creating shellcodes. Cleans MASM file generated by MSVC, gives refactoring hints.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

memory access violation with knock.cpp at function rot13

Frago9876543210 opened this issue · comments

cl /c /GS- /FA knock.cpp
masm_shc.exe knock.asm knock_cleaned_file.asm
ml64 knock_cleaned_file.asm /link /entry:main

E:\masm_shc\demos>.\knock_cleaned_file.exe || echo %errorlevel%
-1073741819

>>> hex(-1073741819 & 0xff_ff_ff_ff)
'0xc0000005'

UPD:

7FF704DC1486: The instruction at 0x7FF704DC1486 referenced memory at 0x7FF704DC11FC. The memory could not be written -> 00007FF704DC11FC (exc.code c0000005, tid 13788)

.text:00007FF704DC1486 mov     [rcx], al
; Line 162
	mov	rax, QWORD PTR i$1[rsp]
	mov	rcx, QWORD PTR str$[rsp]
	add	rcx, rax
	mov	rax, rcx
	movsx	eax, BYTE PTR [rax]
	sub	eax, 13
	mov	rcx, QWORD PTR i$1[rsp]
	mov	rdx, QWORD PTR str$[rsp]
	add	rdx, rcx
	mov	rcx, rdx
	mov	BYTE PTR [rcx], al

looks like exe memory is only r-x, fixed with /section flag

cl /c /GS- /FA knock.cpp
masm_shc.exe knock.asm knock_cleaned_file.asm
ml64 knock_cleaned_file.asm /link /entry:main /section:.text,ERW