Skip to content

Conversation

voidvxvt
Copy link

@voidvxvt voidvxvt commented Oct 25, 2024

Overview
This PR fixes the Demon DLL crash caused by a null pointer dereference.
TLDR: rundll32 demon.x64.dll,Start will work again.

Details
LdrModulePeb is called in DllMain before Instance has been initialized.

Kernel32 = LdrModulePeb( H_MODULE_KERNEL32 );

LdrModulePeb accesses the uninitialized Instance, which is a null pointer derefernce at this point of execution, causing the process to crash.
if ( ! Instance->Teb ) {

I’ve tested the x64 EXE, DLL, and SHC on Windows 11, with WaitForSingleObjectEx, Foliage, Ekko and Zilean sleep obfuscation enabled and all binaries are operating well with this update.

@M4rdc0re
Copy link

I tested it and the shellcode option with sleep jmp gadget "jmp rbx" is not working with your solution don't delete the information of "payloads/Demon/src/Demon.c" and it will work correctly. Actually, you only need to modify the file "payloads/Demon/src/main/MainDll.c"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants