Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Demon DLL #524

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fix Demon DLL #524

wants to merge 1 commit into from

Conversation

voidvxvt
Copy link

@voidvxvt voidvxvt commented Oct 25, 2024

Overview
This PR fixes the Demon DLL crash caused by a null pointer dereference.
TLDR: rundll32 demon.x64.dll,Start will work again.

Details
LdrModulePeb is called in DllMain before Instance has been initialized.

Kernel32 = LdrModulePeb( H_MODULE_KERNEL32 );

LdrModulePeb accesses the uninitialized Instance, which is a null pointer derefernce at this point of execution, causing the process to crash.
if ( ! Instance->Teb ) {

I’ve tested the x64 EXE, DLL, and SHC on Windows 11, with WaitForSingleObjectEx, Foliage, Ekko and Zilean sleep obfuscation enabled and all binaries are operating well with this update.

@M4rdc0re
Copy link

I tested it and the shellcode option with sleep jmp gadget "jmp rbx" is not working with your solution don't delete the information of "payloads/Demon/src/Demon.c" and it will work correctly. Actually, you only need to modify the file "payloads/Demon/src/main/MainDll.c"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants