memexec icon indicating copy to clipboard operation
memexec copied to clipboard

运行报错了

Open YDHCUI opened this issue 2 years ago • 6 comments

thread '' panicked at 'cannot access a Thread Local Storage value during or after destruction: AccessError', library\std\src\thread\local.rs:388:26 note: run with RUST_BACKTRACE=1 environment variable to display a backtrace error: process didn't exit successfully: target\debug\saas.exe (exit code: 0xc0000409, STATUS_STACK_BUFFER_OVERRUN)

exe是用rust写的 直接运行是没问题的

YDHCUI avatar Aug 30 '22 07:08 YDHCUI

我试了go写的exe 正常exe能运行,upx压缩过的exe就不行了

YDHCUI avatar Aug 30 '22 08:08 YDHCUI

这个库用在免杀框架里,所以没更新,bug 还有好几处

在 https://github.com/EddieIvan01/memexec/blob/master/src/peloader/mod.rs#L179 加上

mem::transmute::<*const c_void, PIMAGE_TLS_CALLBACK>(*tls_callback_addr)(
    base_addr,
    DLL_THREAD_ATTACH,
    0 as _,
);

EddieIvan01 avatar Aug 30 '22 08:08 EddieIvan01

好吧,我fork一份自己来改

YDHCUI avatar Aug 30 '22 08:08 YDHCUI

图片 我也是go程序可以,但是rust程序不行,我调试的时候感觉是载入内存后算入口函数出了问题,是不是rust和go编译后的pe有区别。

HToTH avatar Feb 15 '23 02:02 HToTH

@YDHCUI 你好,你解决这个问题了吗?我也遇到同样的问题了

jihuoyouxiang avatar Mar 18 '23 11:03 jihuoyouxiang

我解决这个问题了,主要是因为gnu和msvc的不同。内存执行x86_64-pc-windows-gnu编译的exe就不会出问题。@jihuoyouxiang

HToTH avatar Mar 19 '23 04:03 HToTH