nettitude / runof Goto Github PK

PS C:\Tools\RunOF\RunOF\RunOF> .\bin\x64\Debug\RunOF.exe -f ..\..\demo_files\demo_bof.x64.o
[*] Starting RunOF [x64]
[=] [ParsedArgs:Void .ctor(System.String[])] Parsing 2 Arguments: -f ..\..\demo_files\demo_bof.x64.o
[*] Loading object file ..\..\demo_files\demo_bof.x64.o
[=] [BofRunner:Void .ctor(RunOF.Internals.ParsedArgs)] Initialising bof runner
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] --- Loading object file from byte array ---
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Got file header. Architecture IMAGE_FILE_MACHINE_AMD64
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Parsing 8 section headers
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Parsing 73 symbols
[=] [Coff:Void FindSymbols()] Created list of 73 symbols
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Setting string table offset to 0x2786
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] We need to allocate 7 pages of memory
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Mapped image base @ 0x24fd3410000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Section .text @ 154 sized FE0
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] This section needs 1 pages
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Copying section to 0x24FD3410000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Updating section ptrToRawData to 0
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Section .data @ 0 sized 0
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Section .bss @ 0 sized 10
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] This section needs 1 pages
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Copying section to 0x24FD3411000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Updating section ptrToRawData to 1000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Section .drectve @ 1134 sized 10C
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] This section needs 1 pages
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Copying section to 0x24FD3412000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Updating section ptrToRawData to 2000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Section .rdata @ 1240 sized 620
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] This section needs 1 pages
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Copying section to 0x24FD3413000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Updating section ptrToRawData to 3000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Section .xdata @ 1860 sized 11C
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] This section needs 1 pages
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Copying section to 0x24FD3414000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Updating section ptrToRawData to 4000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Section .pdata @ 197C sized 120
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] This section needs 1 pages
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Copying section to 0x24FD3415000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Updating section ptrToRawData to 5000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Section /4 @ 1A9C sized 20
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] This section needs 1 pages
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Copying section to 0x24FD3416000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Updating section ptrToRawData to 6000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Processing relocations...
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Processing 124 relocations for .text section from offset 1ABC
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: 17 - 23 - IMAGE_REL_AMD64_REL32 - @ 24FD3410017
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: .rdata
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)]       Resolving internal reference
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] reloc_location: 0x24FD3410017, section offset: 0x0 reloc VA: 17
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: 1E - 34 - IMAGE_REL_AMD64_REL32 - @ 24FD341001E
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: __imp_MSVCRT$printf
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Win32API function
[=] [IAT:IntPtr Resolve(System.String, System.String)] Resolving printf from MSVCRT
[=] [IAT:IntPtr Resolve(System.String, System.String)]  Got function address 7FF88A10C890
[=] [IAT:IntPtr Add(System.String, System.String, IntPtr)] Adding MSVCRT$printf at address 7FF88A10C890 to IAT address 24FD3400000
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Current value: 0
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)]       Write relocation to 24FD341001E
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: 27 - 23 - IMAGE_REL_AMD64_REL32 - @ 24FD3410027
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: .rdata
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)]       Resolving internal reference
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] reloc_location: 0x24FD3410027, section offset: 0x0 reloc VA: 27
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: 2E - 35 - IMAGE_REL_AMD64_REL32 - @ 24FD341002E
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: __imp_KERNEL32$LoadLibraryA
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Win32API function
[=] [IAT:IntPtr Resolve(System.String, System.String)] Resolving LoadLibraryA from KERNEL32
[=] [IAT:IntPtr Resolve(System.String, System.String)]  Got function address 7FF8880B95D0
[=] [IAT:IntPtr Add(System.String, System.String, IntPtr)] Adding KERNEL32$LoadLibraryA at address 7FF8880B95D0 to IAT address 24FD3400008
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Current value: 0
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)]       Write relocation to 24FD341002E
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: 51 - 36 - IMAGE_REL_AMD64_REL32 - @ 24FD3410051
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: __imp_NTDLL$RtlNtStatusToDosError
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Win32API function
[=] [IAT:IntPtr Resolve(System.String, System.String)] Resolving RtlNtStatusToDosError from NTDLL
[=] [IAT:IntPtr Resolve(System.String, System.String)]  Got function address 7FF88A303810
[=] [IAT:IntPtr Add(System.String, System.String, IntPtr)] Adding NTDLL$RtlNtStatusToDosError at address 7FF88A303810 to IAT address 24FD3400010
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Current value: 0
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)]       Write relocation to 24FD3410051
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: 8B - 37 - IMAGE_REL_AMD64_REL32 - @ 24FD341008B
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: __imp_FormatMessageA
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Win32API function
[=] [IAT:IntPtr Resolve(System.String, System.String)] Resolving FormatMessageA from KERNEL32
[=] [IAT:IntPtr Resolve(System.String, System.String)]  Got function address 7FF8880B9970
[=] [IAT:IntPtr Add(System.String, System.String, IntPtr)] Adding KERNEL32$FormatMessageA at address 7FF8880B9970 to IAT address 24FD3400018
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Current value: 0
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)]       Write relocation to 24FD341008B
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: C1 - 23 - IMAGE_REL_AMD64_REL32 - @ 24FD34100C1
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: .rdata
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)]       Resolving internal reference
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] reloc_location: 0x24FD34100C1, section offset: 0x0 reloc VA: C1
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: C8 - 34 - IMAGE_REL_AMD64_REL32 - @ 24FD34100C8
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: __imp_MSVCRT$printf
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Win32API function
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Current value: 0
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)]       Write relocation to 24FD34100C8
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: ED - 23 - IMAGE_REL_AMD64_REL32 - @ 24FD34100ED
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: .rdata
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)]       Resolving internal reference
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] reloc_location: 0x24FD34100ED, section offset: 0x0 reloc VA: ED
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: F4 - 34 - IMAGE_REL_AMD64_REL32 - @ 24FD34100F4
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: __imp_MSVCRT$printf
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Win32API function
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Current value: 0
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)]       Write relocation to 24FD34100F4
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: FD - 32 - IMAGE_REL_AMD64_REL32 - @ 24FD34100FD
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: thread_handle
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Win32API function
[=] [IAT:IntPtr Resolve(System.String, System.String)] Resolving thread_handle from KERNEL32
[!!] Unable to load object file - System.Exception: Unable to resolve thread_handle from KERNEL32
   at RunOF.Internals.IAT.Resolve(String dll_name, String func_name) in C:\Tools\RunOF\RunOF\RunOF\Internals\IAT.cs:line 37
   at RunOF.Internals.Coff.ResolveRelocs(IMAGE_SECTION_HEADER section_header) in C:\Tools\RunOF\RunOF\RunOF\Internals\Coff.cs:line 532
   at System.Collections.Generic.List`1.ForEach(Action`1 action)
   at RunOF.Internals.Coff..ctor(Byte[] file_contents, IAT iat) in C:\Tools\RunOF\RunOF\RunOF\Internals\Coff.cs:line 181
[!!] Error! System.Exception: Unable to resolve thread_handle from KERNEL32
   at RunOF.Internals.BofRunner..ctor(ParsedArgs parsed_args) in C:\Tools\RunOF\RunOF\RunOF\Internals\BofRunner.cs:line 50
   at RunOF.Program.Main(String[] args) in C:\Tools\RunOF\RunOF\RunOF\Program.cs:line 45