Hi,
I tried the PoC after understanding how the atom bombing technique works.
However, I ran into a problem when testing the technique. The injection itself works flawlessly. The problem lies in the shell code itself.
The first LoadLibraryA, which tries to load "kernel32.dll", fails (returns 0). When I do a GetLastError, it returns 0x57 = INVALID_PARAMETER. I checked that LoadLibrary is effectively called with the right parameter (cfr. screenshot, taken just before the call to LoadLibraryA).
I think this problem has nothing to do with the injection technique itself. But it puzzles me why this shellcode won't work.
Environment:
- Windows 10 build 17134
- I have tried injecting in 2 different processes (bochs.exe and exeinfope.exe). Both gave same result.
Hi,
I tried the PoC after understanding how the atom bombing technique works.
However, I ran into a problem when testing the technique. The injection itself works flawlessly. The problem lies in the shell code itself.
The first LoadLibraryA, which tries to load "kernel32.dll", fails (returns 0). When I do a GetLastError, it returns 0x57 = INVALID_PARAMETER. I checked that LoadLibrary is effectively called with the right parameter (cfr. screenshot, taken just before the call to LoadLibraryA).
I think this problem has nothing to do with the injection technique itself. But it puzzles me why this shellcode won't work.
Environment: