AtomBombingShellcode fails on LoadLibraryA("kernel32.dll")

[benoitsevens]

Hi,

I tried the PoC after understanding how the atom bombing technique works.

However, I ran into a problem when testing the technique. The injection itself works flawlessly. The problem lies in the shell code itself.

The first LoadLibraryA, which tries to load "kernel32.dll", fails (returns 0). When I do a GetLastError, it returns 0x57 = INVALID_PARAMETER. I checked that LoadLibrary is effectively called with the right parameter (cfr. screenshot, taken just before the call to LoadLibraryA).

I think this problem has nothing to do with the injection technique itself. But it puzzles me why this shellcode won't work.

Environment:

• Windows 10 build 17134
• I have tried injecting in 2 different processes (bochs.exe and exeinfope.exe). Both gave same result.