You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I checked out the project, and run it. There appears no error in the output, but also no notepad.exe.
C:\Repositories\go-runpe>go run cmd\exec\main.go
Creating process: C:\Windows\System32\calc.exe
Process created. Process: 364, Thread: 352
Getting thread context of 352
GetThreadContext[352]: [1] The operation completed successfully.
Address to PEB[Rdx]: a37a82f000
ReadProcessMemory[364 : a37a82f010]: [1] The operation completed successfully.
ReadProcessMemoryAsAddr[364 : a37a82f010]: [7ff771710000] <nil>
Base Address of Source Image from PEB[ImageBaseAddress]: 7ff771710000
Reading destination PE
Getting OptionalHeader of destination PE
ImageBase of destination PE[OptionalHeader.ImageBase]: 140000000
Unmapping view of section 7ff771710000
NtUnmapViewOfSection[364 : 7ff771710000]: [0] The operation completed successfully.
Allocating memory in process at 7ff771710000 (size: 233472)
VirtualAllocEx[364 : 7ff771710000]: [140700736880640] The operation completed successfully.
New base address 7ff771710000
Writing PE to memory in process at 7ff771710000 (size: 1024)
WriteProcessMemory[364 : 7ff771710000]: [1] The operation completed successfully.
Writing section[.text] to memory at 7ff771711000 (size: 155136)
WriteProcessMemory[364 : 7ff771711000]: [1] The operation completed successfully.
Writing section[.rdata] to memory at 7ff771737000 (size: 39424)
WriteProcessMemory[364 : 7ff771737000]: [1] The operation completed successfully.
Writing section[.data] to memory at 7ff771741000 (size: 3584)
WriteProcessMemory[364 : 7ff771741000]: [1] The operation completed successfully.
Writing section[.pdata] to memory at 7ff771744000 (size: 4608)
WriteProcessMemory[364 : 7ff771744000]: [1] The operation completed successfully.
Writing section[.didat] to memory at 7ff771746000 (size: 512)
WriteProcessMemory[364 : 7ff771746000]: [1] The operation completed successfully.
Writing section[.rsrc] to memory at 7ff771747000 (size: 3072)
WriteProcessMemory[364 : 7ff771747000]: [1] The operation completed successfully.
Writing section[.reloc] to memory at 7ff771748000 (size: 1024)
WriteProcessMemory[364 : 7ff771748000]: [1] The operation completed successfully.
Calcuating relocation delta
Relocation delta: -140695368171520
Writing new ImageBase to Rdx 7ff771710000
WriteProcessMemory[364 : a37a82f010]: [1] The operation completed successfully.
Setting new entrypoint to Rcx 7ff771735410
Setting thread context 352
SetThreadContext[352]: [1] The operation completed successfully.
Resuming thread 352
ResumeThread[352]: [1] The operation completed successfully.
C:\Repositories\go-runpe>
Relocation delta: -140695368171520 looks a it weird though.
The text was updated successfully, but these errors were encountered:
I checked out the project, and run it. There appears no error in the output, but also no notepad.exe.
Relocation delta: -140695368171520
looks a it weird though.The text was updated successfully, but these errors were encountered: