Corrupted DataFile.terra with C++ 14.32.31332 about terraldr

[theguly]

@theguly hello, thanks for the details :) DataFile.terra is a file that contains [16 byte key + the payload encrypted with rc4], i dont see how it can be broken, since its just reading - encrypting - writing, the heap corruption is possibly from the injection way, this loader is doing some messy calculations to write the payload, my best guess is NtWriteVirtualMemory's sNumberOfBytesWritten parameter ... while i dont have the same setup, and kinda busy to do this experiment, can u try using "InjectPayload" instead of "InjectPayload2" in the main file here and let me know what happen (try it with the environment that was crashing)

thanks for the reply.

it doesn't make so much sense to me as well, but given the tests i've done that looks like to be the reason.
hopefully it will be easily confirmed /denied by any other user that runs latest c++ redist package, let's just wait for a comment here :)

i'll try to give a deeper look using some debug info but i will probably can't do more digging very soon.

[NUL0x4C]

@theguly hello, thanks for the details :)
DataFile.terra is a file that contains [16 byte key + the payload encrypted with rc4], i dont see how it can be broken, since its just reading - encrypting - writing, the heap corruption is possibly from the injection way, this loader is doing some messy calculations to write the payload, my best guess is NtWriteVirtualMemory's sNumberOfBytesWritten parameter ...
while i dont have the same setup, and kinda busy to do this experiment, can u try using "InjectPayload" instead of "InjectPayload2" in the main file here and let me know what happen (try it with the environment that was crashing)

[NUL0x4C]

and if you want to more details, you can enable uncomment this for debug mode