PowerShell tried to read or write protected memory
I'm not a PowerShell fan at all, but I know my way around C. I get an error after allocating memory with VritualAlloc () and using memset () to write to it.
Also, I am running this from SysWOW64 for x86 compatibility. If architecture is x64, it will restart PS1 and execute it from SysWOW64
Relevant code:
$code = @"
[DllImport("kernel32.dll")]
public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll")]
public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
[DllImport("msvcrt.dll")]
public static extern IntPtr memset(IntPtr dest, uint src, uint count);
"@
$win = Add-Type -memberDefinition $code -Name "Win32" -namespace Win32Functions -passthru
$size = 100;
$vptr=$win::VirtualAlloc(0,0x1000,$size,0x40)
#0x1000 = MEM_COMMIT, 0x40 = PAGE_EXECUE_READWRITE
$win::memset([IntPtr]$vptr, 0x00, 1)
The error I am getting:
Unhandled Exception: System.AccessViolationException: Attempted to read or write protected\
memory. This is often an indication that other memory is corrupt.
Relevant information "bcdedit":
Windows Boot Manager
--------------------
identifier {bootmgr}
device partition=\Device\HarddiskVolume2
path \EFI\Microsoft\Boot\bootmgfw.efi
description Windows Boot Manager
locale en-US
inherit {globalsettings}
integrityservices Enable
default {current}
resumeobject {dda7e6ba-e18d-11e3-b50a-ecf4bb7add72}
displayorder {current}
toolsdisplayorder {memdiag}
timeout 30
Windows Boot Loader
-------------------
identifier {current}
device partition=C:
path \windows\system32\winload.efi
description Windows 8.1
locale en-US
inherit {bootloadersettings}
recoverysequence {dda7e6c4-e18d-11e3-b50a-ecf4bb7add72}
integrityservices Enable
recoveryenabled Yes
isolatedcontext Yes
allowedinmemorysettings 0x15000075
osdevice partition=C:
systemroot \windows
resumeobject {dda7e6ba-e18d-11e3-b50a-ecf4bb7add72}
nx AlwaysOn
bootmenupolicy Standard
vga No
quietboot Yes
bootlog No
sos No
Is this related to DEP / NX? I'm not in a place where I can just reboot my machine right now.
+3
source to share
No one has answered this question yet
Check out similar questions: