I have a Borland C++Builder 6 application which I have added some imports using CFF Explorer, which creates a new section just in case I overwrite the IAT table with patched codes.
There is no antivirus, and all the security features, like the exploit protections, are turned off.
The application is patched with codes which read the command line arguments.
Now, every time I restart the computer the application, it gives the following error:
EAccessViolation
When I check my code it is shown as:
004A4090 60 pushad
004A4091 9C pushfd
004A4092 68 B0424A00 push postquitmessage.4A42B0
004A4097 E8 D4DCED75 call shell32.76381D70 // THIS SHOULD BE SHOWN AS call <kernel32.GetCommandLineW>
004A409C 50 push eax
004A409D E8 8E627375 call 75BDA330 // THIS SHOULD BE SHOWN AS call <shcore.CommandLineToArgvW>
004A40A2 A3 D6434A00 mov dword ptr ds:[4A43D6],eax
004A40A7 833D D6434A00 00 cmp dword ptr ds:[4A43D6],0
004A40AE 0F84 DF000000 je <postquitmessage.loc_40187A>
004A40B4 833D B0424A00 04 cmp dword ptr ds:[4A42B0],4
004A40BB 0F8E D2000000 jle <postquitmessage.loc_40187A>
004A40C1 6A 00 push 0
004A40C3 6A 00 push 0
004A40C5 6A 00 push 0
004A40C7 6A 00 push 0
004A40C9 6A FF push FFFFFFFF
004A40CB 8B15 D6434A00 mov edx,dword ptr ds:[4A43D6]
004A40D1 FF72 04 push dword ptr ds:[edx+4]
004A40D4 6A 00 push 0
004A40D6 6A 00 push 0
004A40D8 E8 139FED75 call shell32.7637DFF0 // THIS SHOULD BE SHOWN AS call <kernel32.WideCharToMultiByte>
004A40DD A3 07454A00 mov dword ptr ds:[4A4507],eax
004A40E2 FF35 07454A00 push dword ptr ds:[4A4507]
004A40E8 E8 9BD31532 call <cc3260mt.@$bnwa$qui> // ADDED IMPORT WHICH IS SHOWN RIGHTLY
004A40ED 59 pop ecx
004A40EE A3 DC454A00 mov dword ptr ds:[4A45DC],eax
004A40F3 6A 00 push 0
004A40F5 6A 00 push 0
004A40F7 FF35 07454A00 push dword ptr ds:[4A4507]
004A40FD FF35 DC454A00 push dword ptr ds:[4A45DC]
004A4103 6A FF push FFFFFFFF
004A4105 8B0D D6434A00 mov ecx,dword ptr ds:[4A43D6]
004A410B FF71 04 push dword ptr ds:[ecx+4]
004A410E 6A 00 push 0
004A4110 6A 00 push 0
004A4112 E8 D99EED75 call shell32.7637DFF0 // THIS SHOULD BE SHOWN AS call <kernel32.WideCharToMultiByte>
004A4117 A1 D6434A00 mov eax,dword ptr ds:[4A43D6]
004A411C FF70 08 push dword ptr ds:[eax+8]
004A411F E8 24231D32 call <cc3260mt.__wtoi>
004A4124 59 pop ecx
004A4125 A3 70464A00 mov dword ptr ds:[4A4670],eax
004A412A 8B15 D6434A00 mov edx,dword ptr ds:[4A43D6]
004A4130 FF72 0C push dword ptr ds:[edx+C]
004A4133 E8 10231D32 call <cc3260mt.__wtoi>
etc. etc.
This is how it is shown after re-applying the patch, and then it works:
004A4090 60 pushad
004A4091 9C pushfd
004A4092 68 B0424A00 push postquitmessage.4A42B0
004A4097 E8 74DFDA74 call <kernel32.GetCommandLineW>
004A409C 50 push eax 004A409D E8 1EF44875 call <shcore.CommandLineToArgvW>
004A40A2 A3 D6434A00 mov dword ptr ds:[4A43D6],eax
004A40A7 833D D6434A00 00 cmp dword ptr ds:[4A43D6],0
004A40AE 0F84 DF000000 je <postquitmessage.loc_40187A>
004A40B4 833D B0424A00 04 cmp dword ptr ds:[4A42B0],4
004A40BB 0F8E D2000000 jle <postquitmessage.loc_40187A>
004A40C1 6A 00 push 0
004A40C3 6A 00 push 0
004A40C5 6A 00 push 0
004A40C7 6A 00 push 0
004A40C9 6A FF push FFFFFFFF
004A40CB 8B15 D6434A00 mov edx,dword ptr ds:[4A43D6]
004A40D1 FF72 04 push dword ptr ds:[edx+4]
004A40D4 6A 00 push 0
004A40D6 6A 00 push 0
004A40D8 E8 B3A1DA74 call <kernel32.WideCharToMultiByte>
004A40DD A3 07454A00 mov dword ptr ds:[4A4507],eax
004A40E2 FF35 07454A00 push dword ptr ds:[4A4507]
004A40E8 E8 9BD31532 call <cc3260mt.@$bnwa$qui>
004A40ED 59 pop ecx
004A40EE A3 DC454A00 mov dword ptr ds:[4A45DC],eax
004A40F3 6A 00 push 0
004A40F5 6A 00 push 0
004A40F7 FF35 07454A00 push dword ptr ds:[4A4507]
004A40FD FF35 DC454A00 push dword ptr ds:[4A45DC]
004A4103 6A FF push FFFFFFFF
004A4105 8B0D D6434A00 mov ecx,dword ptr ds:[4A43D6]
004A410B FF71 04 push dword ptr ds:[ecx+4]
004A410E 6A 00 push 0
004A4110 6A 00 push 0
004A4112 E8 79A1DA74 call <kernel32.WideCharToMultiByte>
004A4117 A1 D6434A00 mov eax,dword ptr ds:[4A43D6]
004A411C FF70 08 push dword ptr ds:[eax+8]
004A411F E8 24231D32 call <cc3260mt.__wtoi>
004A4124 59 pop ecx
004A4125 A3 70464A00 mov dword ptr ds:[4A4670],eax
004A412A 8B15 D6434A00 mov edx,dword ptr ds:[4A43D6]
004A4130 FF72 0C push dword ptr ds:[edx+C]
004A4133 E8 10231D32 call <cc3260mt.__wtoi>
etc. etc.
So, to sum-up, at the beginning when added imports and patched, it works, but every time I restart the computer it gives EAccessViolation
and I have to re-apply the patches to get it working again.
Does anyone knows why this is happening?
3