Windows 11 wow64 error : 0xC0000005

[IgorAkimenk]

violation of access rights during execution at address 0x00000000

[zblwtf]

metoo

[IgorAkimenk]

@zblwtf Any idea how to solve this? Why is this happening?

[zblwtf]

@IgorAkimenk When I was writing a meterpreter extension for the metasploit framework, I discovered that the latest version of meterpreter x86 uses ReflectiveLoader and also uses SysCall. It has similar ideas to SysWhispers3.

So you can take a look at the latest code base of metasploit framework to see the SysCall used by their latest ReflectiveLoader. The specific relevant code is in GateTrampoline32.asm DirectSyscall.c ReflectiveLoader.c.

[zblwtf]

it's okay just don't debug

[klezVirus]

Hi @zblwtf , @IgorAkimenk. I'm seeing this just now, may I have a command line to reproduce?

[Si0uL]

Hello, same issue here on W11 + VS 2022 / 143, I used the following command for generation:

py C:\tools\SysWhispers3\syswhispers.py --functions NtProtectVirtualMemory,NtWriteVirtualMemory,NtAllocateVirtualMemory --arch x86 --wow64 -o ..\syswhispers\syscalls_mem_x86

Note that exact same code compiles on a Windows 10 machine.

[klezVirus]

Hi everyone, thanks for this. Going to test this out in the upcoming days

[xiaoyaoyuanbie]

When compiling in Debug mode, the system call numbers will be cleared, causing errors. The attached image illustrates the differences between Debug and Release versions, highlighting the issue.