madcodehook 3.1 is conflict with comodo security pro 2013?

c++ / delphi package - dll injection and api hooking
Post Reply
oopswin
Posts: 3
Joined: Tue Mar 05, 2013 2:02 pm

madcodehook 3.1 is conflict with comodo security pro 2013?

Post by oopswin »

my computer env is:
windows7 x86 SP1
4GB RAM
security software:
comodo security pro 2013 (ver: 6.0.264710.2708)

when run the demo on my laptop, all the new started process crashed~~~, i try 3 computers is all the same crashed when start process.

the comodo download url is:
http://personalfirewall.comodo.com/como ... y-pro.html
madshi
Site Admin
Posts: 10764
Joined: Sun Mar 21, 2004 5:25 pm

Re: madcodehook 3.1 is conflict with comodo security pro 201

Post by madshi »

When you run which demo? Please try the latest madCodeHook beta build:

http://madshi.net/madCollectionBeta.exe
oopswin
Posts: 3
Joined: Tue Mar 05, 2013 2:02 pm

Re: madcodehook 3.1 is conflict with comodo security pro 201

Post by oopswin »

i'm saddly to say, the new version will crash the same~~~~
oopswin
Posts: 3
Joined: Tue Mar 05, 2013 2:02 pm

Re: madcodehook 3.1 is conflict with comodo security pro 201

Post by oopswin »

when windbg debugger the function we saw the shell code to jmp adress is a invalid address.

Code: Select all

0:000> p
eax=00000001 ebx=773a714c ecx=772dee3f edx=00000030 esi=7ffdb028 edi=7ffdf000
eip=77339000 esp=0017fbac ebp=0017fbec iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntdll!_LdrpInitialize+0x128:
77339000 e99322ffff      jmp     ntdll!_LdrpInitialize+0x1ad (7732b298)
0:000> p
eax=00000001 ebx=773a714c ecx=772dee3f edx=00000030 esi=7ffdb028 edi=7ffdf000
eip=7732b298 esp=0017fbac ebp=0017fbec iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntdll!_LdrpInitialize+0x1ad:
7732b298 e893aafeff      call    ntdll!ZwTestAlert (77315d30)
0:000> t
eax=00000001 ebx=773a714c ecx=772dee3f edx=00000030 esi=7ffdb028 edi=7ffdf000
eip=77315d30 esp=0017fba8 ebp=0017fbec iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntdll!ZwTestAlert:
77315d30 e9cba27efa      jmp     71b00000
0:000> dd 71b0000
071b0000  ???????? ???????? ???????? ????????
071b0010  ???????? ???????? ???????? ????????
071b0020  ???????? ???????? ???????? ????????
071b0030  ???????? ???????? ???????? ????????
071b0040  ???????? ???????? ???????? ????????
071b0050  ???????? ???????? ???????? ????????
071b0060  ???????? ???????? ???????? ????????
071b0070  ???????? ???????? ???????? ????????
madshi
Site Admin
Posts: 10764
Joined: Sun Mar 21, 2004 5:25 pm

Re: madcodehook 3.1 is conflict with comodo security pro 201

Post by madshi »

Sorry for the reply.

Here's a new build which should fix the problem:

http://madshi.net/madCollectionBeta.exe (2.7.4.20)
Post Reply