ntopenprocess hooking crash data

[kitty8904]

windows 10 x64 redstone 5

ntdll.RtlWow64GetProcessMachines

return 00000000C0000008

js flag-> jump -> mov eax,C00000E5 -> return eax ->C00000E5 crash

x32bit module image breakpoint trace result

Size problem or something wrong after NOP hooking occurs when data is read from a 32-bit module

Solution not found in source

[kitty8904]

msdn result

0xC0000008 STATUS_INVALID_HANDLE | An invalid HANDLE was specified.

msdn trace results in an incorrect handle

It seems to happen when reading module information without a handle

A solution to bypass fake handles or handles?

[kitty8904]

Final result

0xC0000008 STATUS_INVALID_HANDLE | An invalid HANDLE was specified.
0xC000000D STATUS_INVALID_PARAMETER | An invalid parameter was passed to a service or function.

call ntdll.RtlWow64GetProcessMachines-->call ntdll.ZwQuerySystemInformationEx
rax 0xC0000008 -> fix rax 0

call ntdll.RtlReplaceSystemDirectoryInPath->rax 0xC000000D -> fix rax 0

If you do this, all 32-bit modules will be visible again. I do not know how to fix this as a source

[cheat-engine]

Can you write an AA script that can make this function?
If so, you can do that in the source with a call to autoassemble as well
(have you tried hooking just ZwQuerySystemInformationEx because the rtl functions can not see if a handle is valid until they pass it of to kernelmode, usually by calling a nt* function)

[kitty8904]

Creating an AA script is easy
(For example, the beginning of a function
function:
(mov rax,0)
(ret)

Can not you handle it technically?

NextPseudoHandle: integer=integer(dword($ce000000));

Is there a problem because the handle is a fake handle but not in the kernel?

It may be a problem that no one cares about, but the Cheet engine without a handle is powerful. I wonder if there is a technological solution

[kitty8904]

handle ok -> orininal module list image

no handle ->ZwQuerySystemInformationEx, RtlWow64GetProcessMachines hook module list image

no handle moudle image address Calculation error

kernel32.sleep
original -76901810
no handle -768fb3f0(error calculation)

If the module is obtained by forcibly changing the return value, the address value is abnormal

It's really hard to solve something without a handle

64-bit modules get normal address values

I'm having trouble to force a 32-bit issue

Module sub-symbol names do not seem to get

Strange symbol name value is obtained

I do not know how to solve it anymore