Causes windows to force shutdown because of internal errors.

[skriptf]

Causes windows to force shutdown because of internal errors.

[Broihon]

Are you accidentally using handle hijacking? Do you have any error logs?

[skriptf]

i was using handle hijacking indeed. unfortunatly error log was super generic. i'll attach one later.

[Broihon]

Any updates on the error logs? I assume the injector tries to use lsass.exe or csrss.exe and the for some reason crashes one of those processes. Even if the logs seem generic I'd still like to take a look.

[Broihon]

@skriptf I finally have a theory how this happened. Do you by any chance have the error log and/or recall whether "only" the system process crashed or if also the target process you were injecting into crashed?

[justanotherskid69]

@Broihon Hey. sorry for ghosting. i completly forgot that i made this issue (also that old github account.)

Unfortunatly, i have that old log but i cant determine what error log is matching log for that issue.

Fortunatly(?), i am able to reproduce that symptoms. Here's the error log.

15-11-2021 12:14:05
Version            : GH Injector V4.4
OS                 : Windows 10 20H2 (Build 19042)
File               : (redacted)
//(!!!this isnt my target process. for some reason it has changed to svchost.)
//(maybe this is making windows to force reboot, not sure since i didnt read this repo's code.)
Target             : svchost.exe 
Target PID         : 13608
Source             : Manual Mapping.cpp in MMAP_NATIVE::ManualMap at line 130
Errorcode          : 0x00000015
Advanced errorcode : 0x00000005
Injectionmode      : ManualMap
Launchmethod       : KernelCallback
Platform           : x64/x86 (native)
HandleValue        : 0x000003A4
Flags              : 0x00FE0041

15-11-2021 12:14:06
Version            : GH Injector V4.4
OS                 : Windows 10 20H2 (Build 19042)
File               : (redacted)
Target             : (undetermined)
Target PID         : 13608
Source             : Injection.cpp in InjectW at line 379
Errorcode          : 0x00000009
Advanced errorcode : 0x00000006
Injectionmode      : ManualMap
Launchmethod       : KernelCallback
Platform           : ---
HandleValue        : 0x000003CC
Flags              : 0x00FE0041

15-11-2021 12:14:06
Version            : GH Injector V4.4
OS                 : Windows 10 20H2 (Build 19042)
File               : (redacted)
Target             : (undetermined)
Target PID         : 13608
Source             : Injection.cpp in HijackHandle at line 565
Errorcode          : 0x00000022
Advanced errorcode : 0x00000000
Injectionmode      : ManualMap
Launchmethod       : KernelCallback
Platform           : x64/x86 (native)
HandleValue        : 0x00000000
Flags              : 0x00FE0071

lmk if i can help you with anything.

[Broihon]

It has changed to svchost because that's the process the handle was hijacked from. I assume for some dumb reason the library crashed a system process like lsass.exe or csrss.exe. In the new version I think I've fixed this issue. So I'll close it for now.
However, handle hijacking will always be kinda janky because it depends on so much shit.