Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Trying any Function from ntdll.dll crashes without error message. #85

Open
Hansbald opened this issue May 20, 2018 · 1 comment
Open

Comments

@Hansbald
Copy link

Hansbald commented May 20, 2018

No matter what function I tried it always crashes without any error message.
It says the DLL got loaded fine, and the function loaded fine too, but when executed it just crashes.

My code for reading DLL into memory:
`HANDLE hFile = CreateFileA("C:\Windows\SysWOW64\ntdll.dll", GENERIC_READ, 0, 0,
OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
if (hFile == NULL) {
printf("Error opening file: %d", GetLastError());
return 0;
}
DWORD dwSize = GetFileSize(hFile, 0);
printf("Size: %d : %d\n", dwSize, GetLastError());

BYTE* buff = new BYTE[dwSize];
if (ReadFile(hFile, buff, dwSize, 0, 0) == FALSE) {
	printf("Error reading file: %d", GetLastError());
	return 0;
}`

Typedef for the function:
typedef NTSTATUS(__stdcall* tdNtTerminateProcess)(HANDLE ProcessHandle, NTSTATUS ExitStatus);

Thanks for the help :)

@Elmue
Copy link

Elmue commented Jun 22, 2020

It does not make any sense to load ntdll.dll into a running process.
Windows automatically loads ntdll.dll into EVERY process as the very first DLL when the process is started.
So if you need any function from ntdll.dll use GetModuleHandle("ntdll.dll") and then GetProcAddress()

By the way: Why do you specify "SysWOW64" in your path?
This is surely wrong.
If you run this in a 32 bit process it is not needed.
If you run this in a 64 bit process you load the wrong DLL into your process..

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants