Blackbone icon indicating copy to clipboard operation
Blackbone copied to clipboard

process.core().native() seems null after re-attach to the process or mmap

Open HandleTlsData opened this issue 4 years ago • 0 comments

Thank you for all the work you have done. Its amazing!

The simple imitation of my problem is: First I manualmap image from memory

proc.Attach( same_pid, PROCESS_ALL_ACCESS );
proc.mmap().MapImage(buff_sz, buff, false, eLoadFlags::WipeHeader, callback, (void*)nullptr, (CustomArgs_t*)nullptr);
proc.Detach();

and then, after some time, when I need to come back to this process:

anotherProc.Attach( same_pid, PROCESS_ALL_ACCESS );
auto mode = blackbone::Worker_UseExisting;
auto status = anotherProc.remote().CreateRPCEnvironment(mode, true);

I get an exception on call_result_t<MemBlock> MemBlock::Allocate on NTSTATUS status = process.core().native()->VirtualAllocExT( desired64, size, MEM_RESERVE | MEM_COMMIT, finalProt ); with Exception thrown: read access violation. process._core._native._Mypair._Myval2 was nullptr.

In Visual Studio local variable inspector we got _process -> _core -> _native with value 'empty' _native | empty | std::unique_ptr<blackbone::Native,std::default_delete<blackbone::Native>>

If try this even without detaching will have same issue. Thanks for your time.

HandleTlsData avatar Aug 03 '21 19:08 HandleTlsData