Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[New] UC_ERR_FETCH_UNMAPPED and A resolved API wasn't an export, it's been replaced with 'kernel32.ExitProcess' from Release 0.4.0 #132

Open
TheMu19099 opened this issue Aug 1, 2024 · 1 comment

Comments

@TheMu19099
Copy link

TheMu19099 commented Aug 1, 2024

Log of the console, i'm getting two warnings that saying "A resolved API wasn't an export, it's been replaced with 'kernel32.ExitProcess'."
Last i got
DEBUG - ERROR:
DEBUG - ERROR: Invalid memory fetch (UC_ERR_FETCH_UNMAPPED)

I don't know what to do in this case, can you help me?
Thank you by the tool, is very useful!

INFO - Detected packer version: 3.x
DEBUG - Probed .text section at (0x1000, 0x32014d)
frida-agent: Setting up OEP tracing for "fileblablabla.exe"
frida-agent: Exception handler registered
frida-agent: OEP found (thread #6156): 0x670387
INFO - OEP reached: OEP=0x670387 BASE=0x400000 DOTNET=False
INFO - Looking for the IAT...
DEBUG - Exports count: 22187
INFO - Performing linear scan in data sections...
DEBUG - Looking for the IAT at (0x401000, 0x1000)
DEBUG - Scanning 100 elements, pointer size is 4
DEBUG - Potential start offset 0x8 for the IAT
DEBUG - Non-null pointer count: 97
DEBUG - Valid APIs count: 0
DEBUG - R*X destination count: 4
DEBUG - Looking for the IAT at (0x722000, 0x1000)
DEBUG - Scanning 100 elements, pointer size is 4
DEBUG - Potential start offset 0x0 for the IAT
DEBUG - Non-null pointer count: 92
DEBUG - Valid APIs count: 13
DEBUG - R*X destination count: 92
INFO - IAT found: 0x722000-0x76867e
INFO - Resolving imports ...
DEBUG - Unmapped memory at 0x359e4ca
DEBUG - Mapped 4096 bytes at 0x359e000
DEBUG - Unmapped memory at 0x3798f0f
DEBUG - Mapped 4096 bytes at 0x3798000
DEBUG - Unmapped memory at 0x33d1122
DEBUG - Mapped 4096 bytes at 0x33d1000
DEBUG - Unmapped memory at 0x33daa15
DEBUG - Mapped 4096 bytes at 0x33da000
DEBUG - Unmapped memory at 0x3799000
DEBUG - Mapped 4096 bytes at 0x3799000
DEBUG - Unmapped memory at 0x35a0d50
DEBUG - Mapped 4096 bytes at 0x35a0000
DEBUG - Unmapped memory at 0x359adf6
DEBUG - Mapped 4096 bytes at 0x359a000
DEBUG - Unmapped memory at 0x3793d7d
DEBUG - Mapped 4096 bytes at 0x3793000
DEBUG - Unmapped memory at 0x379406f
DEBUG - Mapped 4096 bytes at 0x3794000
DEBUG - Unmapped memory at 0x756c003c
DEBUG - Mapped 4096 bytes at 0x756c003c
DEBUG - Mapped 4096 bytes at 0x678000
DEBUG - Unmapped memory at 0x33813b4
DEBUG - Mapped 4096 bytes at 0x3381000
DEBUG - Unmapped memory at 0xbb40e64e
WARNING - A resolved API wasn't an export, it's been replaced with 'kernel32.ExitProcess'.
WARNING - A resolved API wasn't an export, it's been replaced with 'kernel32.ExitProcess'.
#and more other unmapped memory that i'll repeat the above because they are so big text to put here.
DEBUG - Unmapped memory at 0x359e4ca
DEBUG - Mapped 4096 bytes at 0x359e000
DEBUG - Unmapped memory at 0x3798f0f
DEBUG - Mapped 4096 bytes at 0x3798000
DEBUG - Unmapped memory at 0x33d1122
DEBUG - Mapped 4096 bytes at 0x33d1000
DEBUG - Unmapped memory at 0x33daa15
DEBUG - Mapped 4096 bytes at 0x33da000
DEBUG - Unmapped memory at 0x3799000
DEBUG - Mapped 4096 bytes at 0x3799000
DEBUG - Unmapped memory at 0x35a0d50
DEBUG - Mapped 4096 bytes at 0x35a0000
DEBUG - Unmapped memory at 0x359adf6
DEBUG - Mapped 4096 bytes at 0x359a000
DEBUG - Unmapped memory at 0x3793d7d
DEBUG - Mapped 4096 bytes at 0x3793000
DEBUG - Unmapped memory at 0x379406f
DEBUG - Mapped 4096 bytes at 0x3794000
DEBUG - Unmapped memory at 0x756c003c
DEBUG - Mapped 4096 bytes at 0x756c003c
DEBUG - Mapped 4096 bytes at 0x678000
DEBUG - Unmapped memory at 0x33813b4
DEBUG - Mapped 4096 bytes at 0x3381000
DEBUG - Unmapped memory at 0xbb40e64e
DEBUG - ERROR:
DEBUG - ERROR: Invalid memory fetch (UC_ERR_FETCH_UNMAPPED)
DEBUG - PC=0xbb40e64e
DEBUG - SP=0xff001d44
DEBUG - BP=0xff001d58
INFO - Imports resolved: 481
INFO - Fixed IAT at 0x722000, size=0x7dd
INFO - Dumping PE with OEP=0x670387 ...
INFO - Fixing dump ...
INFO - Rebuilding PE ...
DEBUG - .rsrc section found (RVA=0x2fc7000)
DEBUG - .text section found (RVA=0x1000)
INFO - Output file has been saved at 'fileblablabla.exe'
@TheMu19099 TheMu19099 changed the title New A resolved API wasn't an export from Release 4.0 [New] UC_ERR_FETCH_UNMAPPED and A resolved API wasn't an export, it's been replaced with 'kernel32.ExitProcess' from Release 0.4.0 Aug 1, 2024
@martinjechkov
Copy link

+1
there is already an opened issue like this, hopefully ergrelet sees this soon

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants