unlicense icon indicating copy to clipboard operation
unlicense copied to clipboard

How can I be sure _cinit is not invoked during OEP discovery?

Open HybridEidolon opened this issue 1 year ago • 0 comments

For C++ executables, WinMainCRTStartup is responsible for calling a procedure named _cinit, which initializes all C++ statics prior to calling WinMain.

I have a Winlicense 2 packed EXE which I have unpacking successfully (additionally with support for patching a specific call pattern for imports inside the CRT functions), but when it gets inside _cinit and begins initializing things, it eventually hits a seg fault dereferencing null. My hypothesis is that _cinit may have already been called in the process at this point, and it is running initializers on memory that is in an unexpected state because of it. (Either that, or the location of the static memory is not where it should be, which may be symptomatic of Scylla failing to properly dump and fix the running process)

So, during OEP discovery, is there a way to know for sure that it has not executed any part of the entrypoint by the time it is caught after unpacking?

HybridEidolon avatar Aug 09 '22 00:08 HybridEidolon