Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Running unicorn_pe.exe under itself crashes #16

Open
naim94a opened this issue Jun 23, 2020 · 2 comments
Open

Running unicorn_pe.exe under itself crashes #16

naim94a opened this issue Jun 23, 2020 · 2 comments

Comments

@naim94a
Copy link

naim94a commented Jun 23, 2020

I've tried to do a sanity check by running unicorn_pe under itself hoping to see the usage message.

unicorn_pe crashed with an access violation on unicorn_pe.cpp:60 (I'm assuming that the access violation occurs on ((LDR_DATA_TABLE_ENTRY_BASE_T*)modInfo.ldpPtr)->EntryPoint

@hzqst
Copy link
Owner

hzqst commented Apr 22, 2021

Should be fixed with latest commit e7526f9.

@UnlimitedChild
Copy link

Hi,

21602691a9b test eax, eax
21602691a9d je 0x21602691ab7
21602691a9f cmp dword ptr [rip + 0x5830d6], 0
21602691aa6 je 0x21602691ab7
21602691ab7 add rsp, 0x38
21602691abb ret
216024163b1 mov rax, qword ptr gs:[0x30]
216024163ba add rsp, 0x20
216024163be pop rdi
216024163bf ret
21602691146 mov rax, qword ptr [rax + 8]
UC_MEM_READ_UNMAPPED from 8
UC_MEM_READ_UNMAPPED rip at unicorn_pe.exe+6e1146
BlackBone: ManualMap: Unmapping image 'unicorn_pe.exe'

BlackBone: Free: Free at address 0x0000021601FB0000
BlackBone: ManualMap: Unmapping image 'shlwapi.dll'
BlackBone: Free: Free at address 0x0000021603980000
uc_emu_start return: 0
entrypoint return: 0
last rip: 21602691146 (unicorn_pe.exe+6e1146)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants