nettitude / runof Goto Github PK
View Code? Open in Web Editor NEWLicense: BSD 3-Clause "New" or "Revised" License
License: BSD 3-Clause "New" or "Revised" License
PS C:\Tools\RunOF\RunOF\RunOF> .\bin\x64\Debug\RunOF.exe -f ..\..\demo_files\demo_bof.x64.o
[*] Starting RunOF [x64]
[=] [ParsedArgs:Void .ctor(System.String[])] Parsing 2 Arguments: -f ..\..\demo_files\demo_bof.x64.o
[*] Loading object file ..\..\demo_files\demo_bof.x64.o
[=] [BofRunner:Void .ctor(RunOF.Internals.ParsedArgs)] Initialising bof runner
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] --- Loading object file from byte array ---
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Got file header. Architecture IMAGE_FILE_MACHINE_AMD64
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Parsing 8 section headers
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Parsing 73 symbols
[=] [Coff:Void FindSymbols()] Created list of 73 symbols
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Setting string table offset to 0x2786
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] We need to allocate 7 pages of memory
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Mapped image base @ 0x24fd3410000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Section .text @ 154 sized FE0
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] This section needs 1 pages
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Copying section to 0x24FD3410000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Updating section ptrToRawData to 0
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Section .data @ 0 sized 0
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Section .bss @ 0 sized 10
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] This section needs 1 pages
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Copying section to 0x24FD3411000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Updating section ptrToRawData to 1000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Section .drectve @ 1134 sized 10C
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] This section needs 1 pages
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Copying section to 0x24FD3412000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Updating section ptrToRawData to 2000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Section .rdata @ 1240 sized 620
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] This section needs 1 pages
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Copying section to 0x24FD3413000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Updating section ptrToRawData to 3000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Section .xdata @ 1860 sized 11C
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] This section needs 1 pages
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Copying section to 0x24FD3414000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Updating section ptrToRawData to 4000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Section .pdata @ 197C sized 120
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] This section needs 1 pages
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Copying section to 0x24FD3415000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Updating section ptrToRawData to 5000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Section /4 @ 1A9C sized 20
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] This section needs 1 pages
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Copying section to 0x24FD3416000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Updating section ptrToRawData to 6000
[=] [Coff:Void .ctor(Byte[], RunOF.Internals.IAT)] Processing relocations...
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Processing 124 relocations for .text section from offset 1ABC
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: 17 - 23 - IMAGE_REL_AMD64_REL32 - @ 24FD3410017
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: .rdata
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Resolving internal reference
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] reloc_location: 0x24FD3410017, section offset: 0x0 reloc VA: 17
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: 1E - 34 - IMAGE_REL_AMD64_REL32 - @ 24FD341001E
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: __imp_MSVCRT$printf
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Win32API function
[=] [IAT:IntPtr Resolve(System.String, System.String)] Resolving printf from MSVCRT
[=] [IAT:IntPtr Resolve(System.String, System.String)] Got function address 7FF88A10C890
[=] [IAT:IntPtr Add(System.String, System.String, IntPtr)] Adding MSVCRT$printf at address 7FF88A10C890 to IAT address 24FD3400000
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Current value: 0
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Write relocation to 24FD341001E
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: 27 - 23 - IMAGE_REL_AMD64_REL32 - @ 24FD3410027
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: .rdata
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Resolving internal reference
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] reloc_location: 0x24FD3410027, section offset: 0x0 reloc VA: 27
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: 2E - 35 - IMAGE_REL_AMD64_REL32 - @ 24FD341002E
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: __imp_KERNEL32$LoadLibraryA
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Win32API function
[=] [IAT:IntPtr Resolve(System.String, System.String)] Resolving LoadLibraryA from KERNEL32
[=] [IAT:IntPtr Resolve(System.String, System.String)] Got function address 7FF8880B95D0
[=] [IAT:IntPtr Add(System.String, System.String, IntPtr)] Adding KERNEL32$LoadLibraryA at address 7FF8880B95D0 to IAT address 24FD3400008
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Current value: 0
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Write relocation to 24FD341002E
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: 51 - 36 - IMAGE_REL_AMD64_REL32 - @ 24FD3410051
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: __imp_NTDLL$RtlNtStatusToDosError
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Win32API function
[=] [IAT:IntPtr Resolve(System.String, System.String)] Resolving RtlNtStatusToDosError from NTDLL
[=] [IAT:IntPtr Resolve(System.String, System.String)] Got function address 7FF88A303810
[=] [IAT:IntPtr Add(System.String, System.String, IntPtr)] Adding NTDLL$RtlNtStatusToDosError at address 7FF88A303810 to IAT address 24FD3400010
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Current value: 0
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Write relocation to 24FD3410051
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: 8B - 37 - IMAGE_REL_AMD64_REL32 - @ 24FD341008B
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: __imp_FormatMessageA
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Win32API function
[=] [IAT:IntPtr Resolve(System.String, System.String)] Resolving FormatMessageA from KERNEL32
[=] [IAT:IntPtr Resolve(System.String, System.String)] Got function address 7FF8880B9970
[=] [IAT:IntPtr Add(System.String, System.String, IntPtr)] Adding KERNEL32$FormatMessageA at address 7FF8880B9970 to IAT address 24FD3400018
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Current value: 0
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Write relocation to 24FD341008B
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: C1 - 23 - IMAGE_REL_AMD64_REL32 - @ 24FD34100C1
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: .rdata
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Resolving internal reference
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] reloc_location: 0x24FD34100C1, section offset: 0x0 reloc VA: C1
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: C8 - 34 - IMAGE_REL_AMD64_REL32 - @ 24FD34100C8
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: __imp_MSVCRT$printf
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Win32API function
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Current value: 0
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Write relocation to 24FD34100C8
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: ED - 23 - IMAGE_REL_AMD64_REL32 - @ 24FD34100ED
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: .rdata
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Resolving internal reference
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] reloc_location: 0x24FD34100ED, section offset: 0x0 reloc VA: ED
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: F4 - 34 - IMAGE_REL_AMD64_REL32 - @ 24FD34100F4
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: __imp_MSVCRT$printf
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Win32API function
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Current value: 0
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Write relocation to 24FD34100F4
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Got reloc info: FD - 32 - IMAGE_REL_AMD64_REL32 - @ 24FD34100FD
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Relocation name: thread_handle
[=] [Coff:Void ResolveRelocs(RunOF.IMAGE_SECTION_HEADER)] Win32API function
[=] [IAT:IntPtr Resolve(System.String, System.String)] Resolving thread_handle from KERNEL32
[!!] Unable to load object file - System.Exception: Unable to resolve thread_handle from KERNEL32
at RunOF.Internals.IAT.Resolve(String dll_name, String func_name) in C:\Tools\RunOF\RunOF\RunOF\Internals\IAT.cs:line 37
at RunOF.Internals.Coff.ResolveRelocs(IMAGE_SECTION_HEADER section_header) in C:\Tools\RunOF\RunOF\RunOF\Internals\Coff.cs:line 532
at System.Collections.Generic.List`1.ForEach(Action`1 action)
at RunOF.Internals.Coff..ctor(Byte[] file_contents, IAT iat) in C:\Tools\RunOF\RunOF\RunOF\Internals\Coff.cs:line 181
[!!] Error! System.Exception: Unable to resolve thread_handle from KERNEL32
at RunOF.Internals.BofRunner..ctor(ParsedArgs parsed_args) in C:\Tools\RunOF\RunOF\RunOF\Internals\BofRunner.cs:line 50
at RunOF.Program.Main(String[] args) in C:\Tools\RunOF\RunOF\RunOF\Program.cs:line 45
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.