Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

No process started #3

Open
dobin opened this issue Jan 18, 2022 · 0 comments
Open

No process started #3

dobin opened this issue Jan 18, 2022 · 0 comments

Comments

@dobin
Copy link

dobin commented Jan 18, 2022

I checked out the project, and run it. There appears no error in the output, but also no notepad.exe.

C:\Repositories\go-runpe>go run cmd\exec\main.go
Creating process: C:\Windows\System32\calc.exe
Process created. Process: 364, Thread: 352
Getting thread context of 352
GetThreadContext[352]: [1] The operation completed successfully.
Address to PEB[Rdx]: a37a82f000
ReadProcessMemory[364 : a37a82f010]: [1] The operation completed successfully.
ReadProcessMemoryAsAddr[364 : a37a82f010]: [7ff771710000] <nil>
Base Address of Source Image from PEB[ImageBaseAddress]: 7ff771710000
Reading destination PE
Getting OptionalHeader of destination PE
ImageBase of destination PE[OptionalHeader.ImageBase]: 140000000
Unmapping view of section 7ff771710000
NtUnmapViewOfSection[364 : 7ff771710000]: [0] The operation completed successfully.
Allocating memory in process at 7ff771710000 (size: 233472)
VirtualAllocEx[364 : 7ff771710000]: [140700736880640] The operation completed successfully.
New base address 7ff771710000
Writing PE to memory in process at 7ff771710000 (size: 1024)
WriteProcessMemory[364 : 7ff771710000]: [1] The operation completed successfully.
Writing section[.text] to memory at 7ff771711000 (size: 155136)
WriteProcessMemory[364 : 7ff771711000]: [1] The operation completed successfully.
Writing section[.rdata] to memory at 7ff771737000 (size: 39424)
WriteProcessMemory[364 : 7ff771737000]: [1] The operation completed successfully.
Writing section[.data] to memory at 7ff771741000 (size: 3584)
WriteProcessMemory[364 : 7ff771741000]: [1] The operation completed successfully.
Writing section[.pdata] to memory at 7ff771744000 (size: 4608)
WriteProcessMemory[364 : 7ff771744000]: [1] The operation completed successfully.
Writing section[.didat] to memory at 7ff771746000 (size: 512)
WriteProcessMemory[364 : 7ff771746000]: [1] The operation completed successfully.
Writing section[.rsrc] to memory at 7ff771747000 (size: 3072)
WriteProcessMemory[364 : 7ff771747000]: [1] The operation completed successfully.
Writing section[.reloc] to memory at 7ff771748000 (size: 1024)
WriteProcessMemory[364 : 7ff771748000]: [1] The operation completed successfully.
Calcuating relocation delta
Relocation delta: -140695368171520
Writing new ImageBase to Rdx 7ff771710000
WriteProcessMemory[364 : a37a82f010]: [1] The operation completed successfully.
Setting new entrypoint to Rcx 7ff771735410
Setting thread context 352
SetThreadContext[352]: [1] The operation completed successfully.
Resuming thread 352
ResumeThread[352]: [1] The operation completed successfully.

C:\Repositories\go-runpe>

Relocation delta: -140695368171520 looks a it weird though.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant