Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

module_entry: Caught error: invalid_read #239

Open
berrios1 opened this issue Mar 4, 2024 · 6 comments
Open

module_entry: Caught error: invalid_read #239

berrios1 opened this issue Mar 4, 2024 · 6 comments

Comments

@berrios1
Copy link

berrios1 commented Mar 4, 2024

Hello,

Thank you for producing this tool. I get the following error when running this command:

python -m speakeasy -p 1 -o release.json -t release.exe

image

I don't an error when running the executable outside the emulator.

@williballenthin
Copy link
Contributor

can you share the source binary? otherwise, it will be difficult to triage why the emulator tried to read invalid data from address 0x140002fec.

@berrios1
Copy link
Author

berrios1 commented Mar 5, 2024

encryptdecrypthardcodedkey_release.zip

Thank you for taking a look!

@HongThatCong
Copy link
Contributor

Please tell us which version of Unicorn you are installing

@berrios1
Copy link
Author

berrios1 commented Mar 5, 2024

unicorn==1.0.2

@berrios1
Copy link
Author

berrios1 commented Mar 6, 2024

update:

I was using the -p arguement to pass command line arguments into the program being emulated. My main did not have any arguments though. So I hard-coded the option to encrypt and removed cin. Although, I get the same error:

python -m speakeasy -o release.json -t release.exe

  • exec: module_entry
    0x14000424e: 'KERNEL32.GetSystemTimeAsFileTime(0x12fff88)' -> None
    0x14000425c: 'KERNEL32.GetCurrentThreadId()' -> 0x434
    0x140004268: 'KERNEL32.GetCurrentProcessId()' -> 0x420
    0x140004278: 'KERNEL32.QueryPerformanceCounter(0x12fff90)' -> 0x1
    0x140003ce4: 'api-ms-win-crt-runtime-l1-1-0._initterm_e(0x1400053f0, 0x140005408)' -> 0x0
    0x140003d05: 'api-ms-win-crt-runtime-l1-1-0._initterm(0x1400053d0, 0x1400053e8)' -> 0x0
    0x140003d73: 'api-ms-win-crt-runtime-l1-1-0._get_initial_narrow_environment()' -> 0x48e0
    0x140003d7b: 'api-ms-win-crt-runtime-l1-1-0.__p___argv()' -> 0x4a00
    0x140003d83: 'api-ms-win-crt-runtime-l1-1-0.__p___argc()' -> 0x4a50
    0x140003b4f: 'api-ms-win-crt-heap-l1-1-0.malloc(0x20)' -> 0x4a60
    0x140002e0c: module_entry: Caught error: invalid_read
  • Finished emulating
  • Saving emulation report to: release.json

@berrios1
Copy link
Author

Update:

It looks like the issue has to do with using std::cout. Is this a known issue?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants