VirtualAllocEx fails on large image size

[masoudr]

Hi,
I'm testing your code it works fine for small image size (like 200KB). But on large image arrays, I get ERROR_INVALID_PARAMETER on VirtualAllocEx because it is trying to access reserved memory.
So I search and ended up to this topic. But I can't figure it out because I think it is going too complicated. How can we just call VirtualAllocEx without specifying a specific address?
Thanks

[ghost]

the first parameter is NULL means Windows will determines where to allocate the region.

[ghost]

try to increase the stack size

[masoudr]

@whitehat84 Thanks for the answer. Can you be more specific,which parameter should I change in this function:

pImageBase = VirtualAllocEx(PI.hProcess, LPVOID(NtHeader->OptionalHeader.ImageBase),
NtHeader->OptionalHeader.SizeOfImage, 0x3000, PAGE_EXECUTE_READWRITE);

[ehsanr1366]

@masoudr Hi. How do you solve this problem? I have this challenge. Thanks

[MatthMoestl]

Hi, I have the same issue - but I found at least something that made it much better:

// Allocate memory for the context.
CTX = (LPCONTEXT)(VirtualAlloc(NULL, sizeof(*CTX), MEM_COMMIT, PAGE_READWRITE));

this and the increased stack size to 8MB ... makes it work for about 85%

maybe this helps you to finally fix it, I am a newbe in this topics

[MatthMoestl]

Ok I FIXED IT ... works perfect for me :-)

replace
CTX = (LPCONTEXT)(VirtualAlloc(NULL, sizeof(CTX), MEM_COMMIT, PAGE_READWRITE));

with

CTX = (LPCONTEXT)(VirtualAlloc(NULL, sizeof(*CTX), MEM_COMMIT, PAGE_READWRITE));

and replace :
pImageBase = VirtualAllocEx(PI.hProcess, (LPVOID)(NtHeader->OptionalHeader.ImageBase), NtHeader->OptionalHeader.SizeOfImage, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);

with

pImageBase = VirtualAllocEx(PI.hProcess, NULL, NtHeader->OptionalHeader.SizeOfImage, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);

and replace
WriteProcessMemory(PI.hProcess, (LPVOID)(CTX->Ebx + 8), (LPVOID)(&NtHeader->OptionalHeader.ImageBase), 4, 0);

with

WriteProcessMemory(PI.hProcess, (LPVOID)(CTX->Ebx + 8), (LPVOID)(&pImageBase), 4, 0);

[PoloNX]

Hi, I have one error. It says this "E0135 class "_CONTEXT" has no member "Ebx"".
How can I resolve this error ?

[masoudr]

@PoloNX It is because Ebx register isn't available for the X64 platform. But anyway the project doesn't support X64. You need to compile the code for X86 architecture.