CODEWITHSUNDEEP
winapiassemblynasm
MenNotAtWork
MenNotAtWork

Reputation: 165

Nasm - invalid CONTEXT after calling GetThreadContext

I'm writing a PePacker for win32 and while doing so, I found out that I get an invalid CONTEXT out of GetThreadContext.

...
push PINFO                                    ; PROCESS_INFORMATION struct (null initialized)
push STINFO                                   ; STARTUPINFO struct (null initialized)
push 0
push 0
push CREATE_SUSPENDED
push 0
push 0
push 0
push 0
push filepointer                              ; Program file name
call [CreateProcessA]                         ; GetLastError returns 0
cmp eax, 0
jz ending

mov eax, [PINFO+4]                            ; Pinfo.hThread
push eax
call [ResumeThread]                           ; GetLastError returns 0

push 4h                                       ; PAGE_READWRITE
push 1000h                                    ; MEM_COMMIT
push 4h                                       ; sizeof(PCONTEXT)
push 0
call [VirtualAlloc]                           ; GetLastError returns 0

mov [ptrCtx], eax
mov ebx, CONTEXT_FULL
mov [eax], ebx
push eax
mov ebx, [PINFO+4] 
push ebx
call [GetThreadContext]                       ; GetLastError returns 0 but the values of the Context do not fit
cmp eax, 0
jz ending

mov ebx, [ptrCtx]
mov eax, [ebx+56]                             ; CTX.Ebx

push eax                                      ; all below for Testing purpose
push prStr                                    ; prStr = "%d\n"
call [printf]                                 ; prints 0 which is odd because CTX->Ebx should contain an address
pop ecx                                       ;
pop ecx                                       ;
...

The following ReadProcessMemory functions GetLastError call returns 299 which is probably caused by the Invalid CONTEXT entries.

Help is appreciated.

Upvotes: 0

Views: 225

Answers (1)

Drake Wu
Drake Wu

Reputation: 7170

Change the addressing mode from [PINFO+4] to 

mov ebx, [Pinfo]
mov eax, [ebx+4]
push eax

Both in GetThreadContext and ResumeThread.

Upvotes: 1

Related Questions