-1

My program often ends up at the kernel32.TerminateProcess API, now I've tried looking at the callstack in x32dbg but there's nothing. I've tried looking intermodular calls from my module and I've put a breakpoint on all of the calls, but yet it still ends up there.

I've also tried to look at all the intermodular calls to terminate process but they're are way too many, any tips to find it's origin?

5
  • Did you check the stack directly for possible return addresses? Sometimes the callstack cannot be retrieved properly.
    – mrexodia
    Jan 3, 2018 at 9:19
  • There are no addresses on the stack, I dont know why
    – Ayazasker
    Jan 3, 2018 at 10:19
  • 1
    Is EIP perhaps set to an invalid memory location?
    – mrexodia
    Jan 3, 2018 at 10:53
  • Uh yeah, that could be it
    – Ayazasker
    Jan 3, 2018 at 11:17
  • What's the actual issue you're having? This feels like an XY problem. Question could definitely use more detail and explanation.
    – Peanut
    Jan 8, 2018 at 2:26

2 Answers 2

1

From your comments it seems like you're having an exception which was thrown due to failure of access to a memory address. This might happen because of Access Violation or trying to access a non-existent address.

Here's TerminateProcess() syntax:

BOOL WINAPI TerminateProcess(
  _In_ HANDLE hProcess,
  _In_ UINT   uExitCode
);

Check for the ExitCode of the program to understand more what caused the failure:

uExitCode [in]
The exit code to be used by the process and threads terminated as a result of this call. Use the GetExitCodeProcess function to retrieve a process's exit value. Use the GetExitCodeThread function to retrieve a thread's exit value.

You should be able to find the exit code on the stack, or in the failure message.

1

I'd suggest Rohitab's API Monitor. This will allow you to monitor every API call made by an application, and easily inspect parameters passed to each API (and the data returned). One of my favorite tools.

enter image description here

Not the answer you're looking for? Browse other questions tagged or ask your own question.