The inlinewhispers2's discuss from sh0ckfr

sh0ckfr / inlinewhispers2 Goto Github PK

View Code? Open in Web Editor NEW

Tool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF) via Syswhispers2

License: GNU General Public License v3.0

Python 4.43% C 36.35% Assembly 59.22%

inlinewhispers2's Issues

Fails with latest Syswhispers2 update

Hello! Thanks for taking the time to develop this tool. Unfortunately, the latest syswhispers2 update has changed its output to be split between x86 and x64 syscalls, and it has also changed the output naming. This is what Syswhispers2 looks like when run with the commands included in the README.

$ python3 syswhispers.py --preset all -o syscalls_all && cd ..

                  .                         ,--.
,-. . . ,-. . , , |-. o ,-. ,-. ,-. ,-. ,-.    /
`-. | | `-. |/|/  | | | `-. | | |-' |   `-. ,-'
`-' `-| `-' ' '   ' ' ' `-' |-' `-' '   `-' `---
     /|                     |  @Jackson_T
    `-'                     '  @modexpblog, 2021

SysWhispers2: Why call the kernel when you can whisper?

All functions selected.

Complete! Files written to:
	syscalls_all.h
	syscalls_all.c
	syscalls_all_stubs.x86.asm
	syscalls_all_stubs.x86.nasm
	syscalls_all_stubs.x86.s
	syscalls_all_stubs.x64.asm
	syscalls_all_stubs.x64.nasm
	syscalls_all_stubs.x64.s

This breaks InlineWhispers2, because it now fails to read the correct output file when run.

$ python3 InlineWhispers2.py
.___       .__  .__              __      __.__    .__                                   ________
|   | ____ |  | |__| ____   ____/  \    /  \  |__ |__| ____________   ___________  _____\_____  \
|   |/    \|  | |  |/    \_/ __ \   \/\/   /  |  \|  |/  ___/\____ \_/ __ \_  __ \/  ___//  ____/
|   |   |  \  |_|  |   |  \  ___/\        /|   Y  \  |\___ \ |  |_> >  ___/|  | \/\___ \/       \
|___|___|  /____/__|___|  /\___  >\__/\  / |___|  /__/____  >|   __/ \___  >__|  /____  >_______ \
         \/             \/     \/      \/       \/        \/ |__|        \/           \/        \/

Sh0ckFR - https://twitter.com/Sh0ckFR

Traceback (most recent call last):
  File "/Users/davidmckennirey/tools/InlineWhispers2/InlineWhispers2.py", line 120, in <module>
    create_asm_file()
  File "/Users/davidmckennirey/tools/InlineWhispers2/InlineWhispers2.py", line 52, in create_asm_file
    with open('SysWhispers2/syscalls_all_stubs.asm', 'r') as file:
FileNotFoundError: [Errno 2] No such file or directory: 'SysWhispers2/syscalls_all_stubs.asm'

Recommend Projects