Cant load kernel32 windows 10 home #54

Activity

1. fancycode commented on Sep 22, 2016

   

   fancycode

   on Sep 22, 2016

   Owner

   More actions

   What exactly is the previous and what is this version?
2. jazzybecker commented on Sep 23, 2016

   

   jazzybecker

   on Sep 23, 2016

   Author

   More actions

   the version 0.0.3 is work very good sir. why in this version cant load kernel32.dll from memory ?
3. undergroundwires commented on Feb 6, 2017

   

   undergroundwires

   on Feb 6, 2017

   Last edited by undergroundwires

   More actions

   Windows 10 trying to load Kernel32.dll gives me ERROR_BAD_EXE_FORMAT at 512th line in MemoryModule.h :

       GetNativeSystemInfo(&sysInfo);
       alignedImageSize = AlignValueUp(old_header->OptionalHeader.SizeOfImage, sysInfo.dwPageSize);
       if (alignedImageSize != AlignValueUp(lastSectionEnd, sysInfo.dwPageSize)) {
           SetLastError(ERROR_BAD_EXE_FORMAT);
           return NULL;
       }
   

   "%1 is not a valid Win32 application."

   Shell32.dll loads and run fine.

   MemoryModule loads the kernel32.dll without any problem if I just comment out that if check.
4. lynnux commented on Dec 10, 2018

   

   lynnux

   on Dec 10, 2018

   More actions

   Yes, I have the same problem when load "ntdll.dll" on win7 x64.
   It seems the alignment checking are failed, due to old_header->OptionalHeader.SectionAlignment is 0x1000 for normal dlls, but for ntdll is 0x10000, and the kernel32 is also 0x10000!

   the previous version don't have AlignValueUp stuff, so should be work.
5. Elmue commented on Jun 22, 2020

   

   Elmue

   on Jun 22, 2020

   Last edited by Elmue

   More actions

   Why do you want to load ntdll.dll or kernel32.dll into any running process?
   These are the first DLLs which Windows loads into ANY process as the first DLLs when the process is started.
   Use GetModuleHandle("ntdll.dll") or GetModuleHandle("kernel32.dll") instead!
6. own2k commented on Jun 23, 2020

   

   own2k

   on Jun 23, 2020

   Last edited by own2k

   More actions

   Very interesting what is the purpose to load kernel32 or ntdll with MemoryModule?
7. jazzybecker commented on Jun 30, 2023

   

   jazzybecker

   on Jun 30, 2023

   Author

   More actions

   Hello, sorry for late reply.
   Back then, i used to "cheat" on game that using nProtect. Yes it can direct syscall, but im too lazy writing shellcode for different Windows. xD