Scylla dump error #1434

Open
gmastergreatee opened this Issue Jan 22, 2017 · 2 comments

Projects

None yet

3 participants

@gmastergreatee
gmastergreatee commented Jan 22, 2017 edited

GbbeFId
Download target file
Download LenaTute27(contains target)

I had this peculiar Scylla error. Reproduction steps :-

1>Load the file bootca.exe in x32dbg.
2>Run till EIP = Entrypoint(for cases when system breakpoint is enabled in settings)
3>Make sure there are no exceptions in the "Exceptions List" in Options
4>Now, hit F9 or click on Run button 20 times to land on the address 0068E7FA(the last exception instruction before the app starts running)
5>Go to "Memory View" & set breakpoint on bootca.exe as shown in the gif file(Try pressing F2 after selecting the memory region, for me it didn't work so I had to use the context menu -> happens sometimes).
6>Now, hit F9 or click on Run button once more to land on the OEP of the file.
7>Now, try to dump the process from memory & voila, Scylla hangs.

Maybe this is OS related. Please look into this.

I'm using:-

Windows 8 -> 64 bit

Thank you for your time
Feel free to close.

@gmastergreatee
gmastergreatee commented Jan 22, 2017 edited

More info - ChimpREC does the job well(dumping)

Download Link
NOTE : Antivirus may detect false positives
Supplementary(maybe helpful):-
What is ChimpREC & how it works

@skillax
skillax commented Feb 10, 2017

Probably related to #1425
You're using the 2017-01-19 release, which is about the last build affected by this; could you please retry with the latest 2017-02-05 version ? I'll bet that one works :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment