Hi,
I tried your tool with the Docker version. When I run a standard command:
python3 Boaz.py -f ./output/meterpreter.exe -o ./output/boaz_output4.exe -l 1
And then execute the resulting .exe file on a Windows computer, I get the following error:
First 8 bytes: e8 c0 97 05 00 c0 97 05
Last 8 bytes: 00 00 00 00 00 00 00 00
[+] Searching for syscall #1 in NtAllocateVirtualMemory @ 00007ffcbb9a3520
[+] Found syscall #1 for NtAllocateVirtualMemory at 00007ffcbb9a3532
[+] Found syscall number: 24
[+] press enter to allocate memory
[+] Allocated size: 391638
[+] MagicCode size: 391638
[+] Searching for syscall #1 in NtWriteVirtualMemory @ 00007ffcbb9a3960
[+] Found syscall #1 for NtWriteVirtualMemory at 00007ffcbb9a3972
[+] Memory written
[+] Memory changed to PAGE_EXECUTE_READ
[+] Found BaseThreadInitThunk @ 00007ffcb992e8c0
[+] Found pattern @ 0x00007ffcb992e8cc
[+] Found 'mov rcx, r8' at 00007ffcb992e8cc
[-] Expected call instruction not found.
Do you know what might be causing this issue? Could it be related to memory protection mechanisms?
Best regards,
Hi,
I tried your tool with the Docker version. When I run a standard command:
python3 Boaz.py -f ./output/meterpreter.exe -o ./output/boaz_output4.exe -l 1
And then execute the resulting .exe file on a Windows computer, I get the following error:
Do you know what might be causing this issue? Could it be related to memory protection mechanisms?
Best regards,