Bios NX/XD, Windows Data Execution Prevention (DEP) & LoadLibraryA & Error 998

[anon23294430]

@anon77170705

The error 998 means that the Windows Kernel caught the Access Denied exception caused by mismatching of type of memory access operation and protection settings for the accessed memory region. Examples:

• attempt to access memory with address less 64K
• attempt to access memory outside any allocated region
• attempt to execute code stored in the memory block having none of PAGE_EXECUTE, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE or PAGE_EXECUTE_WRITECOPY flags in the protection attribute.

Where do you get this information from? I cant find this level of info anywhere and I’ve certainly spent years trying to find this sort of info.

Thanks for the update.

Edit.

@anon77170705

attempt to access memory with address less 64K

Looking at what I was doing last night, which was accessing the Resource Name ID’s which are in the 64K region, this might have triggered it, namely trying to access the multitude of icons and cursors in the Resource Type RT_Group_Cursor and RT_Group_Icon sections. ie I was seeing if I could display more of the icons.

So what you have put above makes sense.

Having just used a long with a 64k value in instead of the MakeIntResource macro had worked, but I also created a procedure called MakeIntResource which took the Long/Ulong* and returned a Ushort in case there was some internal clarion runtime thing taking place.

MAKEINTRESOURCEA macro (winuser.h) - Win32 apps | Microsoft Learn
c++ - Why does MAKEINTRESOURCE() work? - Stack Overflow

*Some api’s which work with EnumResourceName’s show Ulongs and others Long’s. There’s a bit of mismatch with MS’s docs.

Edit.

I’m not too sure, because I’m getting plagued by 998’s again now and all I’ve done is shutdown and restart the computer, call LoadLibrary, and then call EnumResourceTypesA and it throws a 998 error, every time!

DEP is switched on on the Host Win10 machine and Virtual XP machine. The other change I have noticed is with the Clarion Debugger. It usually shows a source code window in the top left pane, but its stopped doing this and now shows nothing when I toggle the DEP settings. Weird to say the least and with the other problems with this computer makes me think this machine is not air gapped properly!

Edit.

I have DEP switched on on the Win10 host and virtual XP OS and its still throwing 998 errors, so its looking like malware.

There’s got to be some malware or something being loaded with LoadLibraryA which isnt being loaded with LoadLibraryExA and its totally random when it strikes, ie can reboot physical and virtual OS’s and it will strike straight away throwing a 998 with DEP switched off or on.

Ergo’s there has to be some malware messing around with this computer, that LoadLibraryA is triggering, thats assuming there isnt some stealth means to mess with this computer that bridges the airgap.