Skip to content

Expected call instruction not found. #21

Description

@yannled

Hi,

I tried your tool with the Docker version. When I run a standard command:
python3 Boaz.py -f ./output/meterpreter.exe -o ./output/boaz_output4.exe -l 1

And then execute the resulting .exe file on a Windows computer, I get the following error:

First 8 bytes: e8 c0 97 05 00 c0 97 05
Last 8 bytes: 00 00 00 00 00 00 00 00
[+] Searching for syscall #1 in NtAllocateVirtualMemory @ 00007ffcbb9a3520
[+] Found syscall #1 for NtAllocateVirtualMemory at 00007ffcbb9a3532
[+] Found syscall number: 24
[+] press enter to allocate memory

[+] Allocated size: 391638
[+] MagicCode size: 391638
[+] Searching for syscall #1 in NtWriteVirtualMemory @ 00007ffcbb9a3960
[+] Found syscall #1 for NtWriteVirtualMemory at 00007ffcbb9a3972
[+] Memory written
[+] Memory changed to PAGE_EXECUTE_READ
[+] Found BaseThreadInitThunk @ 00007ffcb992e8c0
[+] Found pattern @ 0x00007ffcb992e8cc
[+] Found 'mov rcx, r8' at 00007ffcb992e8cc
[-] Expected call instruction not found.

Do you know what might be causing this issue? Could it be related to memory protection mechanisms?
Best regards,

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions