Looking at vld.cpp, I think the problem is the patching of NtDll is wrong with newer version of windows. I think I can fix it, but I need some help but I need a screenshot. If anyone has Windows 7 64bit, please git clone the repo, use vs2015 to compile a 64bit version of the project, then run test_basics. All tests should pass and the program exists without a crash. If this is the case, place a break point at the line "NtDllPatch.pPatchAddress = NtDllFindParamAddress(pReturnAddress);" in vld.cpp. When it breaks, please screenshot the disassembly of the address in pReturnAddress. I believe the byte code for finding the params, call address and the patched byte codes all need to be updated.
↧