1

There's a closed source binary that I'm analyzing, and there's a call to VirtualProtect that fails.

However, VirtualProtect stores the error code somewhere accesible only via GetLastError, and the binary doesn't even import that function.

Can I somehow get the error code without hooking?

5

GetLastError simply returns LastErrorValue from the TEB (Thread Environment Block) of the thread concerned.

You can access TEB of the current thread through the segment register FS.

FS:[0x18] contains the pointer to TEB.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.