-
Notifications
You must be signed in to change notification settings - Fork 272
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
PsWrapApcWow64Thread cause normalRoutine to become invalid. #4
Comments
Post your code. I think you passed invalid parameters. |
Ok, So i had some issue of the parameters, but i'm still experiencing an issue with the wow64 wrapper method. So here's how i define my inputs :
Notice that in my case, the context and inputs are irrelevant and they are all initialized to NULL. After i call The original method address however, is still in user-space and points to the method imeplemntation
Perhaps you can tell me if you see any issues with my flow ? Thanks ! |
This seems like correct behavior. |
However, i cannot reach the break point of the normal routine (I set break point of the address it was allocated in from the context of the injected process). It seems like the process is stuck. When i tried to analyzed it I saw that one of the threads' call-stack is stuck on wow64ApcRoutine. any ideas how to further debug this issue ?
|
PsWrapApcWow64Thread result is normal. |
Yes, i guess that's was the problem. now it's fixed. thanks you. |
Hi,
I've got a question regarding the usage of the undocumented method
PsWrapApcWow64Thread
that is used to support regular 32bits normalRoutines to wow64 processes.
Basically i've used your project with replacing the section memory allocation with
ZwProtectVirtualMemory
for user-space memory allocation on the context of the process I wish to inject to. I'm using VM of windows 10 RS5.reading the memory from winDbg, the candidate NormalRoutine function looked pretty much like a normal function in assembly code :
However, after calling the method
PsWrapApcWow64Thread
with this function I got the following wrapping :First, i thought that the original function was relocated to address
00880108
, but when i read this section in memory i got all zerosSo it seems that the wrapping cause the code to jump to "zeroes" code.
Any idea what went wrong ?
The text was updated successfully, but these errors were encountered: