Author Topic: Windows ExitProcess call fail !  (Read 6350 times)

Offline pikeplan9

  • New Member
  • Posts: 1
Windows ExitProcess call fail !
« on: June 08, 2013, 11:09:17 AM »
I have the following code
Code: [Select]
; ExitProcess(0)
push 0
call [ebp + 8]; exit process
is this related to stack alignment ?
it fails eax set to 2 and error code INVALID_PARAMETER_ID
screen shot

Offline shellc0de

  • Jr. Member
  • *
  • Posts: 12
Re: Windows ExitProcess call fail !
« Reply #1 on: June 08, 2013, 11:36:05 AM »
Try this?
Code: [Select]
[BITS 32]
xor eax,eax
push eax
mov eax,0x7c81d20a
call eax
Sorry,0x7c81d20a this is address of ExitProces in kernel you must use dllexport to see what address is at your pc.
« Last Edit: June 08, 2013, 11:41:03 AM by shellc0de »

Online Frank Kotler

  • NASM Developer
  • Hero Member
  • *****
  • Posts: 2628
  • Country: us
Re: Windows ExitProcess call fail !
« Reply #2 on: June 08, 2013, 06:05:04 PM »
This seems a little weird to me. What would be an "invalid" parameter to ExitProcess? What reason do you have to think that ExitProcess is at [ebp + 8]? Did you put it there? I would suspect that the error is from some other API.

As far as using some specific address for ExitProcess, doesn't MS randomize this stuff every Tuesday? I don't know much Windows, but this seems spectacularly non-portable!

What's wrong with:
Code: [Select]
global start
extern ExitProcess
section .text
push 0
call ExitProcess

As an experiment, can you get that error from ANY parameter to ExitProcess?