How do i get rid of this segmentation fault

[unreal wolf]

run in a debugger and show the stack trace and instruction where it faults

what is the signature of the function you're trying to call?

[dreamy birch]

If you are trying to call a function, u need to follow the x86 calling convention

This includes saving the caller saved registers, aligning the stack, setting up args, etc

[unkempt belfry]

that's not necessarily true, we need way more context than we currently have to know what's needed

(hence why 190cueb asked for it)

[dreamy birch]

Oh true u don’t have to follow a specific convention if it’s not visible externally

[unkempt belfry]

I mean, every function has a calling convention, but what it is depends on OP's code

[dreamy birch]

Yeah

[late hawk]

Okay, first problem. How do i run this in debugger if i'm injecting code into other process, i mean i need to launch my process that injects dll which will run with the code

[late hawk]

fn function(arg: [*:0]const u8) bool

[late hawk]

I copied this type to my hook also, i checked code in IDA it is really similar to my declaration, also compiled with same target and optimize arguments, both zig compiled

So i find this function by comparing bytes inside program's virtual memory, so maybe there is another function like this one but different and i just didn't notice it when checking disassembler

I'll check that again later and tell you for sure

[unkempt belfry]

This would be significantly easier to solve if you actually showed us all of the relevant code:

• The actual function you are trying to call
• The trampoline code (which you have shown), and how you're compiling it (inline asm? a separate assembly file built with... nasm, or something else?)
• How that trampoline is being called (it sounds like you're hooking something? if so, what's the exact signature of the function you're hooking?)

My best guess with the information you've provided so far is that you're trying to hook a function at runtime via a trampoline, and that function uses the C calling convention and has a C signature of bool (const u8 *). If that's accurate, then:

• Rewriting the start of the function to a single jmp (possibly with a mov first, I forget some x86_64 addressing details) is indeed the correct thing to use
• The function you are calling must have callconv(.c)

[unreal wolf]

you could launch the process that is going to be injected in a debugger, break on the function that you are trying to hook, then let the process continue and run the injector code elsewhere

[late hawk]

what is rx?

[unreal wolf]

i think they're asking about the permissions on the memory where it is stored (set with mprotect on posix)
it should be readable and executable

[late hawk]

so not create process but just open it with uuid?

[unreal wolf]

most memory isn't executable by default so if you copy bytes somewhere and jump to it it won't work

[late hawk]

i set PAGE_EXECUTE_READWRITE to both

[unreal wolf]

oh is your zig program creating the process it will inject into?

then what you could do is make the child process that gets injected print out its pid and sleep for a few seconds before doing anything, and in that time you can use your debugger's attach option with the pid to start debugging the child process

[late hawk]

so i have zig injector which creates process and injects dll into it

[late hawk]

to be honest i asked chat gpt to generate that code with online asm opcodes list like this: https://c9x.me/x86/html/file_module_x86_id_147.html

[late hawk]

so i shluld try using callconv(.c) on my payload?

[unreal wolf]

you still haven't shared enough info but, shot in the dark, how do you get the address that you move into rax?

[unreal wolf]

callconv(.c) is certainly necessary, but i don't know if it will fix everything

[late hawk]

sorry for not sharing but i'm currently playing a game and also didn't proceed with debugger stack trace

[unreal wolf]

well what is the hex code it generated?

[late hawk]

var ShellCode: [12]u8 = .{
0x48, 0xB8,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xFF, 0xE0
};

i am filling 0x00 with my address of a variable

[unreal wolf]

is ShellCode the only thing you inject into the target process?

the address of the variable/function you try to jump to will not be valid in the target process unless you put it there

[late hawk]

Okay so here is my injector:

Here is my dll:

[late hawk]

(lldb) process status
Process 4440 stopped

• thread #5, stop reason = Exception 0x80000003 encountered at address 0x7ffa23c34940
  frame #0: 0x00007ffa23c34941 ntdll.dllDbgBreakPoint + 1 ntdll.dllDbgBreakPoint:
  -> 0x7ffa23c34941 <+1>: retq
  0x7ffa23c34942 <+2>: int3
  0x7ffa23c34943 <+3>: int3
  0x7ffa23c34944 <+4>: int3
  (lldb) process continue
  Process 4440 resuming
  Process 4440 stopped
• thread #1, stop reason = Exception 0x80000003 encountered at address 0x7ff71230adee
  frame #0: 0x00007ff71230adef TestApp.exe
  -> 0x7ff71230adef: movl $0x3, %ecx
  0x7ff71230adf4: callq 0x7ff7123a8c60
  0x7ff71230adf9: movq -0x8(%rbp), %rcx
  0x7ff71230adfd: callq 0x7ff71230ff00
  (lldb) process continue
  Process 4440 resuming
  Process 4440 exited with status = 3 (0x00000003)
  (lldb)

so this this lldb output.
Firstly i create process and inject dll, let it run it's functions, then i resume process and it's where second Expeption 0x80000003 hit on 0x7ff71230adee

[late hawk]

printed function address was: 7ff7123814e0

(lldb) disassemble -a 7ff7123814e0
error: Could not find function bounds for address 0x7ff7123814e0

[late hawk]

people problem is still active, i still need some recommendations from you

[late hawk]

People, problem is still here