PowerShell tried to read or write protected memory

I'm not a PowerShell fan at all, but I know my way around C. I get an error after allocating memory with VritualAlloc () and using memset () to write to it.

Also, I am running this from SysWOW64 for x86 compatibility. If architecture is x64, it will restart PS1 and execute it from SysWOW64

Relevant code:

$code = @"
[DllImport("kernel32.dll")]
public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll")]
public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
[DllImport("msvcrt.dll")]
public static extern IntPtr memset(IntPtr dest, uint src, uint count);
"@
$win = Add-Type -memberDefinition $code -Name "Win32" -namespace Win32Functions -passthru
$size = 100;

$vptr=$win::VirtualAlloc(0,0x1000,$size,0x40)
#0x1000 = MEM_COMMIT, 0x40 = PAGE_EXECUE_READWRITE

$win::memset([IntPtr]$vptr, 0x00, 1)

      

The error I am getting:

Unhandled Exception: System.AccessViolationException: Attempted to read or write protected\
memory. This is often an indication that other memory is corrupt.

      

Relevant information "bcdedit":

Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=\Device\HarddiskVolume2
path                    \EFI\Microsoft\Boot\bootmgfw.efi
description             Windows Boot Manager
locale                  en-US
inherit                 {globalsettings}
integrityservices       Enable
default                 {current}
resumeobject            {dda7e6ba-e18d-11e3-b50a-ecf4bb7add72}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 30

Windows Boot Loader
-------------------
identifier              {current}
device                  partition=C:
path                    \windows\system32\winload.efi
description             Windows 8.1
locale                  en-US
inherit                 {bootloadersettings}
recoverysequence        {dda7e6c4-e18d-11e3-b50a-ecf4bb7add72}
integrityservices       Enable
recoveryenabled         Yes
isolatedcontext         Yes
allowedinmemorysettings 0x15000075
osdevice                partition=C:
systemroot              \windows
resumeobject            {dda7e6ba-e18d-11e3-b50a-ecf4bb7add72}
nx                      AlwaysOn
bootmenupolicy          Standard
vga                     No
quietboot               Yes
bootlog                 No
sos                     No

      

Is this related to DEP / NX? I'm not in a place where I can just reboot my machine right now.

+3


source to share





All Articles