Shellcode Process Hollowing Issue about osep-code-snippets HOT 3 CLOSED

Ah.. ha... My problem that I didn't XOR my payload so I didn't need that portion of the code to decode it. Once I commented that portion out it worked like a charm. Thank you for taking the time to respond and help a newbie out. Cheers!

from osep-code-snippets.

Hi! Thanks, glad to hear the snippets are useful!

It looks like the program is trying to read the bytes at offset 0xe004d4 in an array (dataBuf) for which only 0x200 bytes are allocated. This is obviously outside of the buffer and as such throws the out of range error.

Looking at your addresses, it looks like you may have compiled the solution as x86. Could that be the case? If so, please compile it as x64 and try again. If not, could you please supply some more details on how you are compiling and running the solution (OS build, etc), since I'm not able to reproduce the issue currently!

For reference, this is what succesful execution should look like. Notice the difference in offset values!

from osep-code-snippets.

Oh interesting, wouldn't have guessed that based on the original error. Thanks for sharing your solution!

from osep-code-snippets.