Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Parent process exiting/dying on systemcall, is this the intended functionality? #4

Open
Azrotronik opened this issue Apr 21, 2022 · 0 comments

Comments

@Azrotronik
Copy link

I'm wrapping CreateProcess.go or CreateThread.go or CreateThreadNative.go in functions as the following snippet shows

func main(){
//Processing
runCreateThread() // or syscall, or createProcess... Just the regular functions to pop calc.exe, completely unchanged!
//More processing
}

It seems that runCreateThread() does the intended functionality of popping calc.exe, but the parent process exits every time right after CreateThread.

If Debug is enabled, The last thing i see is [DEBUG]Calling CreateThread...

What makes this weirder is that I'm not getting any Go-related errors or panics, just a silent exit.
This has been tested with syscall, createProcess, CreateThread and CreateThreadNative

Maybe the issue is RtlCopyMemory overwriting memory? or am i far off the mark?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant