Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unexpected program termination during emulation #22

Open
UnlimitedChild opened this issue Mar 1, 2021 · 1 comment
Open

Unexpected program termination during emulation #22

UnlimitedChild opened this issue Mar 1, 2021 · 1 comment

Comments

@UnlimitedChild
Copy link

UnlimitedChild commented Mar 1, 2021

Hi,

unicorn_pe cpudata.exe -disasm
BlackBone: Allocate: Allocating at address 0x0000023ECC610000 (0x1000 bytes)
BlackBone: Allocate: Allocating at address 0x0000023ECC620000 (0x1000 bytes)
BlackBone: Allocate: Allocating at address 0x0000023ECC630000 (0x4000 bytes)
BlackBone: ManualMap: Mapping image 'cpudata.exe' with flags 0x1d001
BlackBone: ManualMap: Loading new image 'cpudata.exe'
BlackBone: ManualMap: Image base allocated at 0x0000023ecc640000
BlackBone: ManualMap: Performing image copy
BlackBone: ManualMap: Relocating image 'cpudata.exe'
BlackBone: ManualMap: Calling entry point for 'cpudata.exe', Reason: 1
BlackBone: ManualMap: DllMain of 'cpudata.exe' returned 0
BlackBone: Free: Decommit at address 0x0000023ECC64B000 (0x1000 bytes)
23ecc641000 enter 0x80, 0
23ecc641004 sub rsp, 0x60
23ecc641008 xor rcx, rcx
23ecc64100b call qword ptr [rip + 0x3057]
UC_MEM_FETCH_UNMAPPED from 7ff8535ce090
UC_MEM_FETCH_UNMAPPED rip at 7ff8535ce090
BlackBone: ManualMap: Unmapping image 'cpudata.exe'
BlackBone: ManualMap: Calling entry point for 'cpudata.exe', Reason: 0

here the program exits, but it was not closed manually, it works normally for a while, and then closes spontaneously.

cpudata.zip

It was a debug version, on the release version the behavior is similar
unicorn_pe cpudata.exe
UC_MEM_FETCH_UNMAPPED from 140704527212688
UC_MEM_FETCH_UNMAPPED rip at 140704527212688
uc_emu_start return: 8
entrypoint return: 0
last rip: 167095a100b (cpudata.exe+100b)

Doesn't work with additional options at all - unicorn_pe controls.exe -disasm.
Doesn't start - unicorn_pe cpuid.exe

@UnlimitedChild
Copy link
Author

Second case ..

unicorn_pe controls.exe -disasm
BlackBone: Allocate: Allocating at address 0x0000027CB2560000 (0x1000 bytes)
BlackBone: Allocate: Allocating at address 0x0000027CB3B90000 (0x1000 bytes)
BlackBone: Allocate: Allocating at address 0x0000027CB3BA0000 (0x4000 bytes)
BlackBone: ManualMap: Mapping image 'controls.exe' with flags 0x1d001
BlackBone: ManualMap: Loading new image 'controls.exe'
BlackBone: ManualMap: Image base allocated at 0x0000027cb3bb0000
BlackBone: ManualMap: Performing image copy
BlackBone: ManualMap: Relocating image 'controls.exe'
BlackBone: ManualMap: Loading new dependency 'gdiplus.dll'
BlackBone: ManualMap: Dependency path resolved to 'C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.18362.418_none_17b1a56c6d9fd02b\gdiplus.dll'
BlackBone: ManualMap: Loading new image 'C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.18362.418_none_17b1a56c6d9fd02b\gdiplus.dll'
BlackBone: ManualMap: Image base allocated at 0x0000027cb3bc0000
BlackBone: ManualMap: Performing image copy
BlackBone: ManualMap: Relocating image 'c:\windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.18362.418_none_17b1a56c6d9fd02b\gdiplus.dll'
BlackBone: ManualMap: Performing security cookie initializtion for image 'gdiplus.dll'
BlackBone: ManualMap: Loading new dependency 'shell32.dll'
BlackBone: ManualMap: Dependency path resolved to 'C:\Windows\system32\SHELL32.dll'
BlackBone: ManualMap: Loading new image 'C:\Windows\system32\SHELL32.dll'
BlackBone: ManualMap: Image base allocated at 0x0000027cb6f60000
BlackBone: ManualMap: Performing image copy
BlackBone: ManualMap: Relocating image 'c:\windows\system32\shell32.dll'
BlackBone: ManualMap: Loading new dependency 'windows.storage.dll'
BlackBone: ManualMap: Dependency path resolved to 'c:\windows\system32\windows.storage.dll'
BlackBone: ManualMap: Loading new image 'c:\windows\system32\windows.storage.dll'
BlackBone: ManualMap: Image base allocated at 0x0000027cb7d40000
BlackBone: ManualMap: Performing image copy
BlackBone: ManualMap: Relocating image 'c:\windows\system32\windows.storage.dll'
BlackBone: ManualMap: Loading new dependency 'profapi.dll'
BlackBone: ManualMap: Dependency path resolved to 'c:\windows\system32\profapi.dll'
BlackBone: ManualMap: Loading new image 'c:\windows\system32\profapi.dll'
BlackBone: ManualMap: Image base allocated at 0x0000027cb4630000
BlackBone: ManualMap: Performing image copy
BlackBone: ManualMap: Relocating image 'c:\windows\system32\profapi.dll'
BlackBone: ManualMap: Performing security cookie initializtion for image 'profapi.dll'
BlackBone: ManualMap: Loading new dependency 'shcore.dll'
BlackBone: ManualMap: Dependency path resolved to 'C:\Windows\system32\SHCORE.dll'
BlackBone: ManualMap: Loading new image 'C:\Windows\system32\SHCORE.dll'
BlackBone: ManualMap: Image base allocated at 0x0000027cb8cb0000
BlackBone: ManualMap: Performing image copy
BlackBone: ManualMap: Relocating image 'c:\windows\system32\shcore.dll'
BlackBone: ManualMap: Performing security cookie initializtion for image 'shcore.dll'
BlackBone: ManualMap: Loading new dependency 'powrprof.dll'
BlackBone: ManualMap: Dependency path resolved to 'c:\windows\system32\powrprof.dll'
BlackBone: ManualMap: Loading new image 'c:\windows\system32\powrprof.dll'
BlackBone: ManualMap: Image base allocated at 0x0000027cb8e70000
BlackBone: ManualMap: Performing image copy
BlackBone: ManualMap: Relocating image 'c:\windows\system32\powrprof.dll'
BlackBone: ManualMap: Loading new dependency 'umpdc.dll'
BlackBone: ManualMap: Dependency path resolved to 'c:\windows\system32\umpdc.dll'
BlackBone: ManualMap: Loading new image 'c:\windows\system32\umpdc.dll'
BlackBone: ManualMap: Image base allocated at 0x0000027cb8ec0000
BlackBone: ManualMap: Performing image copy
BlackBone: ManualMap: Relocating image 'c:\windows\system32\umpdc.dll'
BlackBone: ManualMap: Performing security cookie initializtion for image 'umpdc.dll'
BlackBone: ManualMap: Performing security cookie initializtion for image 'powrprof.dll'
BlackBone: ManualMap: Performing security cookie initializtion for image 'windows.storage.dll'
BlackBone: ManualMap: Loading new dependency 'cfgmgr32.dll'
BlackBone: ManualMap: Dependency path resolved to 'c:\windows\system32\cfgmgr32.dll'
BlackBone: ManualMap: Loading new image 'c:\windows\system32\cfgmgr32.dll'
BlackBone: ManualMap: Image base allocated at 0x0000027cb9020000
BlackBone: ManualMap: Performing image copy
BlackBone: ManualMap: Relocating image 'c:\windows\system32\cfgmgr32.dll'
BlackBone: ManualMap: Performing security cookie initializtion for image 'cfgmgr32.dll'
BlackBone: ManualMap: Loading new dependency 'cryptsp.dll'
BlackBone: ManualMap: Dependency path resolved to 'c:\windows\system32\cryptsp.dll'
BlackBone: ManualMap: Loading new image 'c:\windows\system32\cryptsp.dll'
BlackBone: ManualMap: Image base allocated at 0x0000027cb9120000
BlackBone: ManualMap: Performing image copy
BlackBone: ManualMap: Relocating image 'c:\windows\system32\cryptsp.dll'
BlackBone: ManualMap: Performing security cookie initializtion for image 'cryptsp.dll'
BlackBone: ManualMap: Performing security cookie initializtion for image 'shell32.dll'
BlackBone: ManualMap: Calling entry point for 'gdiplus.dll', Reason: 1
BlackBone: ManualMap: DllMain of 'gdiplus.dll' returned 1
BlackBone: Free: Decommit at address 0x0000027CB3D61000 (0x2000 bytes)
BlackBone: ManualMap: Calling entry point for 'profapi.dll', Reason: 1
BlackBone: ManualMap: DllMain of 'profapi.dll' returned 1
BlackBone: Free: Decommit at address 0x0000027CB464E000 (0x1000 bytes)
BlackBone: ManualMap: Calling entry point for 'shcore.dll', Reason: 1
BlackBone: ManualMap: DllMain of 'shcore.dll' returned 1
BlackBone: Free: Decommit at address 0x0000027CB8D55000 (0x4000 bytes)
BlackBone: ManualMap: Calling entry point for 'umpdc.dll', Reason: 1
BlackBone: ManualMap: DllMain of 'umpdc.dll' returned 1
BlackBone: Free: Decommit at address 0x0000027CB8ECF000 (0x1000 bytes)
BlackBone: ManualMap: Calling entry point for 'powrprof.dll', Reason: 1
BlackBone: ManualMap: DllMain of 'powrprof.dll' returned 1
BlackBone: Free: Decommit at address 0x0000027CB8EB9000 (0x1000 bytes)
BlackBone: ManualMap: Calling entry point for 'windows.storage.dll', Reason: 1

end of processing, the program is not loaded :(
controls.zip

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant