Comments (2)
drewvis
commented on May 20, 2024
1
Hi, thanks for pointing this out. So the reason that invalid_read error occurred was because loadlibrary returned NULL in your example. The shellcode didn't perform any error checking and crashed with a NULL pointer dereference. This is because by default, speakeasy will do what it can to provide a decoy PE for shellcode to parse (based on the functions that are currently supported for emulation).
I went ahead and added support for urlmon.dll and that sample fully emulates now.
In the future you can supply a "decoy directory" with the "-l" command line option containing real DLLs like urlmon.dll. This instructs speakeasy to load the decoy DLL when shellcode accesses it.
Hope that helps, thanks for the feedback.
from speakeasy.
LloydLabs
commented on May 20, 2024
Awesome, thanks for the speedy fix @drewvis! I'll be sure to submit a PR if I come across any other APIs that are yet to be implemented 👍
from speakeasy.
Related Issues (20)
- implement wcstombs
- implement msvcrt__EH_prolog HOT 1
- Requires unicorn version: 1.0.2. Relax this requirement? HOT 1
- Unsupported API NETAPI32.NetUserAdd
- ImportError on cli.py HOT 7
- Package on Pypi.org HOT 2
- Timeout issue on sample
- log_process_event only logs external thread injection HOT 1
- undefined name 'out' HOT 3
- Please add image base in report json files
- Bug in parse command line args to input file
- Error with Vector Exception Handler HOT 2
- "Hello World" in Golang HOT 8
- Bug in read string from UNICODE_STRING and ANSI_STRING HOT 5
- UC_MEM_READ_PROT | Potential bug on memory allocation permissions HOT 5
- Question about stack size - alloc_stack HOT 1
- Example Binaries or Output
- Possibility to rebase shellcode
- module_entry: Caught error: invalid_read HOT 6
- Unsupported API: MSVCP140.??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ (ret: 0x1400026b9)
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from speakeasy.