BEX error when trying to run mingw-built hc on Windows

[KOLANICH]

The hc from official site causes BEX error. It is related to DEP and ASLR (on my system they are mandatary for all processes). Builds built with Visual Studio (the old pre-refactoring version I've managed to build with VS) doesn't have this problem. Seemengly Microsoft knows their system much better than MinGW devs ;).

[jsteube]

Please explain, what is that BEX error and which effects does it have?

[KOLANICH]

Please explain, what is that BEX error and which effects does it have?

BEX refers to Buffer Overflow Exception.

https://support.solarwinds.com/Success_Center/Log_Event_Manager_(LEM)/Buffer_overflow_exception_(BEX)_error_from_Reports_Console_due_to_Data_Execution_Prevention_(DEP)

It is often triggered by an attempt to execute the code on a page marked as NoneXecutable. In any case when I've built hc with VS (after my modifications) the problem either disappeared or hid.

I've checked your binary with PE format inspector (PeStudio) and found that it is imcompatible with dep and aslr (I have them forced enabled for all the processes). You may need try to mess with compiler and linker flags.

[jsteube]

Sounds like some mingw issue and not sure which compiler and linker flags you mean. Also, how did you notice this? hashcat runs normally on my Windows 7.

[KOLANICH]

Sounds like some mingw issue and not sure which compiler and linker
flags you mean. Also, how did you notice this? hashcat runs normally on
my Windows 7.

Again, I have DEP force-enabled for all the processes, even for those not explicitly marked as dep-enabled. It doesn't cause issues in most cases. In the case of hc from the website it did. You can try to solve it by adding -Wl --nxcompat --dynamicbase into the command line (I don't know which command line exactly).

[jsteube]

OK I've added it and created some new beta binaries. Can you test please and close the issue if fixed?

[KOLANICH]

Sorry, it is not clear how I can download it. On the website I see only August version and the listing of binaries directory (https://hashcat.net/files/) is disabled.

[jsteube]

Binary beta can be found here: https://hashcat.net/beta/

But I make the change in the current master branch, too: https://github.com/hashcat/hashcat/blob/master/src/Makefile#L176

You can also try to compile from source on windows (Msys2 works fine).

[jsteube]

@KOLANICH did it work?

[KOLANICH]

Sorry, I was without inet for some time. It doesn't. PEStudio showed the flags (dep and aslr) had appeared, but it still crashes, though with another error (exception code 80000003).

[neheb]

i cannot reproduce. what windows version is this? DEP is set to always on on my machine.

[KOLANICH]

I use Windows 8.1. Is it forced? Do you have EMET?

[neheb]

Yes

…

On Sat, Nov 26, 2016, 02:11 KOLANICH ***@***.***> wrote: Is it forced? Do you he EMET? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#530 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ACyJ2aFwVXv4mxpoCfGRk6nxbIgnGX_5ks5rCAXMgaJpZM4KQjNY> .

[jsteube]

Can we close this issue?

[KOLANICH]

I don't know. I don't have Windows on my PC anymore.

[jsteube]

I've added that flags only for you. I guess I can close the ticket now.

[KOLANICH]

Thank you anyway.