I have a Borland C++ builder 6 application which I have added some imports using CFF Explorer, with create a new section just in case I overwrite the IAT table with patched codes.
There is no antivirus and all the security features, like the exploit protections, are turned off.
The application is patched with codes which read the command line arguments.
Now, every time I restart the computer the application gives the following error:
EAccessViolation
When I check my code it is shown as:
004A4090 | 60 | pushad | 004A4091 | 9C | pushfd | 004A4092 | 68 B0424A00 | push postquitmessage.4A42B0 | 004A4097 | E8 D4DCED75 | call shell32.76381D70 | THIS SHOULD BE SHOWN AS call <kernel32.GetCommandLineW> 004A409C | 50 | push eax | 004A409D | E8 8E627375 | call 75BDA330 | THIS SHOULD BE SHOWN AS call <shcore.CommandLineToArgvW> 004A40A2 | A3 D6434A00 | mov dword ptr ds:[4A43D6],eax | 004A40A7 | 833D D6434A00 00 | cmp dword ptr ds:[4A43D6],0 | 004A40AE | 0F84 DF000000 | je <postquitmessage.loc_40187A> | 004A40B4 | 833D B0424A00 04 | cmp dword ptr ds:[4A42B0],4 | 004A40BB | 0F8E D2000000 | jle <postquitmessage.loc_40187A> | 004A40C1 | 6A 00 | push 0 | 004A40C3 | 6A 00 | push 0 | 004A40C5 | 6A 00 | push 0 | 004A40C7 | 6A 00 | push 0 | 004A40C9 | 6A FF | push FFFFFFFF | 004A40CB | 8B15 D6434A00 | mov edx,dword ptr ds:[4A43D6] | 004A40D1 | FF72 04 | push dword ptr ds:[edx+4] | 004A40D4 | 6A 00 | push 0 | 004A40D6 | 6A 00 | push 0 | 004A40D8 | E8 139FED75 | call shell32.7637DFF0 | THIS SHOULD BE SHOWN AS call <kernel32.WideCharToMultiByte> 004A40DD | A3 07454A00 | mov dword ptr ds:[4A4507],eax | 004A40E2 | FF35 07454A00 | push dword ptr ds:[4A4507] | 004A40E8 | E8 9BD31532 | call <cc3260mt.@$bnwa$qui> | ADDED IMPORT WHICH IS SHOWN RIGHTLY 004A40ED | 59 | pop ecx | 004A40EE | A3 DC454A00 | mov dword ptr ds:[4A45DC],eax | 004A40F3 | 6A 00 | push 0 | 004A40F5 | 6A 00 | push 0 | 004A40F7 | FF35 07454A00 | push dword ptr ds:[4A4507] | 004A40FD | FF35 DC454A00 | push dword ptr ds:[4A45DC] | 004A4103 | 6A FF | push FFFFFFFF | 004A4105 | 8B0D D6434A00 | mov ecx,dword ptr ds:[4A43D6] | 004A410B | FF71 04 | push dword ptr ds:[ecx+4] | 004A410E | 6A 00 | push 0 | 004A4110 | 6A 00 | push 0 | 004A4112 | E8 D99EED75 | call shell32.7637DFF0 | THIS SHOULD BE SHOWN AS call <kernel32.WideCharToMultiByte> 004A4117 | A1 D6434A00 | mov eax,dword ptr ds:[4A43D6] | 004A411C | FF70 08 | push dword ptr ds:[eax+8] | 004A411F | E8 24231D32 | call <cc3260mt.__wtoi> | 004A4124 | 59 | pop ecx | 004A4125 | A3 70464A00 | mov dword ptr ds:[4A4670],eax | 004A412A | 8B15 D6434A00 | mov edx,dword ptr ds:[4A43D6] | 004A4130 | FF72 0C | push dword ptr ds:[edx+C] | 004A4133 | E8 10231D32 | call <cc3260mt.__wtoi> | etc. etc.
This is how is shown after re-applying the patch and then it works:
004A4090 | 60 | pushad | 004A4091 | 9C | pushfd | 004A4092 | 68 B0424A00 | push postquitmessage.4A42B0 | 004A4097 | E8 74DFDA74 | call <kernel32.GetCommandLineW> | 004A409C | 50 | push eax | 004A409D | E8 1EF44875 | call <shcore.CommandLineToArgvW> | 004A40A2 | A3 D6434A00 | mov dword ptr ds:[4A43D6],eax | 004A40A7 | 833D D6434A00 00 | cmp dword ptr ds:[4A43D6],0 | 004A40AE | 0F84 DF000000 | je <postquitmessage.loc_40187A> | 004A40B4 | 833D B0424A00 04 | cmp dword ptr ds:[4A42B0],4 | 004A40BB | 0F8E D2000000 | jle <postquitmessage.loc_40187A> | 004A40C1 | 6A 00 | push 0 | 004A40C3 | 6A 00 | push 0 | 004A40C5 | 6A 00 | push 0 | 004A40C7 | 6A 00 | push 0 | 004A40C9 | 6A FF | push FFFFFFFF | 004A40CB | 8B15 D6434A00 | mov edx,dword ptr ds:[4A43D6] | 004A40D1 | FF72 04 | push dword ptr ds:[edx+4] | 004A40D4 | 6A 00 | push 0 | 004A40D6 | 6A 00 | push 0 | 004A40D8 | E8 B3A1DA74 | call <kernel32.WideCharToMultiByte> | 004A40DD | A3 07454A00 | mov dword ptr ds:[4A4507],eax | 004A40E2 | FF35 07454A00 | push dword ptr ds:[4A4507] | 004A40E8 | E8 9BD31532 | call <cc3260mt.@$bnwa$qui> | 004A40ED | 59 | pop ecx | 004A40EE | A3 DC454A00 | mov dword ptr ds:[4A45DC],eax | 004A40F3 | 6A 00 | push 0 | 004A40F5 | 6A 00 | push 0 | 004A40F7 | FF35 07454A00 | push dword ptr ds:[4A4507] | 004A40FD | FF35 DC454A00 | push dword ptr ds:[4A45DC] | 004A4103 | 6A FF | push FFFFFFFF | 004A4105 | 8B0D D6434A00 | mov ecx,dword ptr ds:[4A43D6] | 004A410B | FF71 04 | push dword ptr ds:[ecx+4] | 004A410E | 6A 00 | push 0 | 004A4110 | 6A 00 | push 0 | 004A4112 | E8 79A1DA74 | call <kernel32.WideCharToMultiByte> | 004A4117 | A1 D6434A00 | mov eax,dword ptr ds:[4A43D6] | 004A411C | FF70 08 | push dword ptr ds:[eax+8] | 004A411F | E8 24231D32 | call <cc3260mt.__wtoi> | 004A4124 | 59 | pop ecx | 004A4125 | A3 70464A00 | mov dword ptr ds:[4A4670],eax | 004A412A | 8B15 D6434A00 | mov edx,dword ptr ds:[4A43D6] | 004A4130 | FF72 0C | push dword ptr ds:[edx+C] | 004A4133 | E8 10231D32 | call <cc3260mt.__wtoi> | etc. etc.
So to sum-up, at the beginning when added imports and patched it works, but every time I restart the computer it gives EAccessViolation and I have to re-apply the patches to get it working again.
Does anyone knows why this is happening?