PROGRAM ABORT : Process exited before reaching the target method - due to partial memory read from process

[piotrbania]

PROGRAM ABORT : Process exited before reaching the target method - due to partial memory read from process

[ifratric]

Hey Piotr,

Thanks for reporting! Looks like the approach of reading the entire module in one go isn't working well in this case and needs to be rewritten somewhat.

Just to understand the issue better, do you know how come Jackalope wasn't erroring out with "Error reading target memory" instead of erroring out with "Process exited before reaching the target method"? I'd expect getting the former error if there was an issue with memory read. Or did you change the reading code already at this point.

For anyone reading, the alternative to -target_method is specifying the offset directly via -target_offset which doesn't do the symbol lookup.

[piotrbania]

AFAIR i had to change the some variable in the debugger.cpp to verbose debug events otherwise i only got:
[!] WARNING: Target function not reached, retrying with a clean process
...
[-] PROGRAM ABORT : Process exited before reaching the target method

maybe there was some verbose flag in the command line that i forgot about :)

[ifratric]

Hi, the GetProcOffset issue should be fixed in googleprojectzero/TinyInst@338dde5
It now reads only PE headers and the export table, so unusual permissions on other pages shouldn't matter.

I'm tentatively closing the issue, but I'd appreciate it if you could give it a spin against your target again and check if it works correctly.