go-shellcode icon indicating copy to clipboard operation
go-shellcode copied to clipboard

Parent process exiting/dying on systemcall, is this the intended functionality?

Open Azrotronik opened this issue 3 years ago • 0 comments

I'm wrapping CreateProcess.go or CreateThread.go or CreateThreadNative.go in functions as the following snippet shows

func main(){
//Processing
runCreateThread() // or syscall, or createProcess... Just the regular functions to pop calc.exe, completely unchanged!
//More processing
}

It seems that runCreateThread() does the intended functionality of popping calc.exe, but the parent process exits every time right after CreateThread.

If Debug is enabled, The last thing i see is [DEBUG]Calling CreateThread...

What makes this weirder is that I'm not getting any Go-related errors or panics, just a silent exit. This has been tested with syscall, createProcess, CreateThread and CreateThreadNative

Maybe the issue is RtlCopyMemory overwriting memory? or am i far off the mark?

Azrotronik avatar Apr 21 '22 01:04 Azrotronik