Bios NX/XD, Windows Data Execution Prevention (DEP) & LoadLibraryA & Error 998

[anon77170705]

@anon23294430

I had swapped the Peek(type,GloQ.Cstringvalue) with Glo:Q.CstringValue = Addr2String(type) when I’d seen your test.clw, and the Addr2String was causing the problems. I’ve put it back to Peek(… and its working again.

Addr2CString (Cla$PushCString) can cause GPF in 2 cases:

1. Value passed as a parameter is not valid address
2. Passed address points to not 0-terminated string

PEEK must cause GPF in case (1) too. Because PEEK copies SIZE(destination variable) bytes from the memory pointed by passed address, value of the destination CSTRING variable should become broken in case (2).

@anon23294430

I’m guessing there is no datatype conversion or something else going on when I use Addr2String().

Cla$PushCString pushes characters from passed address to first 0-character to the string stack. This values is popping from the stack to a destination variable if Addr2CString is using in the right side of assignment. Popping from the string stack can cause GPF only if destination address is wrong.