XR3X

Jump to content


Photo

NtAllocateVirtualMemory Shellcode Problem


  • You cannot start a new topic
  • Please log in to reply
10 replies to this topic

#1 sonykuccio

sonykuccio

    Intermediate Member

  • Loyalist
  • Reputation: 189
    Very Good
  • 155 posts
  • LocationALU

Posted 27 May 2013 - 03:00 AM

Hi All, i have a really badass problem when im trying to call the NtAllocateVirtualMemory

 export from ntdll library

 

so this is the how stack Look

 

CPU Dump
Address   Hex dump                                         ASCII
0018FB40                          BC 00 00 00|00 00 40 00|         [email protected]
0018FB50  00 00 00 00|00 50 04 00|00 30 00 00|40 00 00 00| [email protected]
 

BC 00 00 00 = HANDLE ProcessHandle

00 00 40 00 = Imagebase

00 00 00 00 = ULONG_PTR ZeroBits

00 50 04 00 = Size of image

00 30 00 00 = ULONG AllocationType

40 00 00 00  = ULONG Protect

 

This is how i call in ASM

 

Push 0x40
push 0x3000

 

; edi register hold many values it's a pointer to a 80 byte structure where i store all value i need

mov ecx,dword[edi] ; 'PE signature'
mov ecx,dword[ecx+0x50] ;SizeOfImage
push ecx

 

push 0

push dword[edi+4];IMAGEBASE

 

mov ecx,dword[edi+8]
push dword[ecx] ;tPROCESS_INFORMATION

call eax ; eax Hold Ntdll NtAllocateVirtualMemory pointer

 

and i always get this hex error -3ffffffb i think is STATUS_ACCESS_DENIED or STATUS_ACCESS_VIOLATION

 

so what im doing wrong? thanks !

 

 

 

 

 

 

 



#2 LeFF

LeFF

    Advanced Member

  • Moderator
  • Reputation: 457
    Very Good
  • 426 posts
Contributor

Posted 27 May 2013 - 04:25 AM

-3ffffffb

what is that? how do you even got this strange value? get an unsigned hexdecimal value from eax (or from PEB->LastNtStatus) and find it in

Please Login or Register to see this Hidden Content

...



#3 sonykuccio

sonykuccio

    Intermediate Member

  • Loyalist
  • Reputation: 189
    Very Good
  • 155 posts
  • LocationALU

Posted 27 May 2013 - 11:49 AM

I got  0xC0000005 STATUS_ACESS_VIOLATION



#4 LeFF

LeFF

    Advanced Member

  • Moderator
  • Reputation: 457
    Very Good
  • 426 posts
Contributor

Posted 27 May 2013 - 12:20 PM

try using debugger, maybe pages at imagebase are already commited/reserved...



#5 sonykuccio

sonykuccio

    Intermediate Member

  • Loyalist
  • Reputation: 189
    Very Good
  • 155 posts
  • LocationALU

Posted 27 May 2013 - 12:22 PM

im using NtUnmapViewOfSection

 

wich return NT_STATUS_SUCCESS



#6 LeFF

LeFF

    Advanced Member

  • Moderator
  • Reputation: 457
    Very Good
  • 426 posts
Contributor

Posted 27 May 2013 - 01:00 PM

im using NtUnmapViewOfSection

just check if the pages are able to commit with debugger...



#7 Indy

Indy

    Banned

  • Banned
  • Reputation: 41
    Fair
  • 71 posts

Posted 27 May 2013 - 01:55 PM

2nd arg: IN OUT PVOID *BaseAddress, this link. R/W access, region is free.
 
Remember the DEP(NXSEH). If it enabled(and mem not IMAGE), then exception will not be processed  ;)

  • sonykuccio likes this

#8 sonykuccio

sonykuccio

    Intermediate Member

  • Loyalist
  • Reputation: 189
    Very Good
  • 155 posts
  • LocationALU

Posted 27 May 2013 - 02:06 PM

 

2nd arg: IN OUT PVOID *BaseAddress, this link. R/W access, region is free.
 
Remember the DEP(NXSEH). If it enabled(and mem not IMAGE), then exception will not be processed  ;)

 

 

Yes my error was to Push the value of the imagebase, but i must push the prt to the value ;)

 

thanks i solved !



#9 Hess

Hess

    Intelligence Service

  • Loyalist
  • Reputation: 766
    Excellent
  • 2,821 posts
  • LocationBelgrade
Contributor

Posted 28 May 2013 - 08:48 AM

If You solved it last night on shoutbox , than , I guess , this is it. :)



#10 sonykuccio

sonykuccio

    Intermediate Member

  • Loyalist
  • Reputation: 189
    Very Good
  • 155 posts
  • LocationALU

Posted 28 May 2013 - 02:28 PM

If You solved it last night on shoutbox , than , I guess , this is it. :)

was a different problem but yes i solved :D


  • Hess likes this

#11 Hess

Hess

    Intelligence Service

  • Loyalist
  • Reputation: 766
    Excellent
  • 2,821 posts
  • LocationBelgrade
Contributor

Posted 28 May 2013 - 04:00 PM

Then , cheers ! :D