Hello, I am trying to obtain the DFIR-Orc.exe binary but I have some errors.
I follow the tutorial ; So I have clonned the dfir-orc-config repository and copy binaries DFIR-ORC_x86.exe and DFIR-ORC_x64.exe in the tools folder.
But when I run
.\Configure.cmd
I have these errors :
Configuring Orc (.\output\DFIR-Orc.exe) with config: .\config
ToolEmbed v10.1.4
Embed/Extract configuration data and tools
2022-11-08T15:12:37.719Z [I] ** Backtrace Start **
2022-11-08T15:12:37.659Z [D] Enable stdout redirection with WriteConsole
2022-11-08T15:12:37.662Z [D] Library class Orc::NtDllExtension is not yet loaded
2022-11-08T15:12:37.662Z [D] TryLoad for references 'ntdll.dll'
2022-11-08T15:12:37.662Z [D] ExtensionLibrary: Loading value 'ntdll.dll'
2022-11-08T15:12:37.667Z [D] Opening 'C:\Windows\System32\cmd.exe' for resource 'ntdll.dll' of type 'VALUES'
2022-11-08T15:12:37.667Z [D] Opening 'C:\Windows\explorer.exe' for resource 'ntdll.dll' of type 'VALUES'
2022-11-08T15:12:37.667Z [D] ExtensionLibrary: Loaded 'ntdll.dll' successfully
2022-11-08T15:12:37.667Z [D] ExtensionLibrary: Loaded 'C:\WINDOWS\SYSTEM32\ntdll.dll' successfully
2022-11-08T15:12:37.667Z [D] TryLoad succeeded for reference 'ntdll.dll'
2022-11-08T15:12:37.667Z [D] Library class Orc::Kernel32Extension is not yet loaded
2022-11-08T15:12:37.667Z [D] TryLoad for references 'kernel32.dll'
2022-11-08T15:12:37.667Z [D] ExtensionLibrary: Loading value 'kernel32.dll'
2022-11-08T15:12:37.672Z [D] Opening 'C:\Windows\System32\cmd.exe' for resource 'kernel32.dll' of type 'VALUES'
2022-11-08T15:12:37.672Z [D] Opening 'C:\Windows\explorer.exe' for resource 'kernel32.dll' of type 'VALUES'
2022-11-08T15:12:37.672Z [D] ExtensionLibrary: Loaded 'kernel32.dll' successfully
2022-11-08T15:12:37.672Z [D] ExtensionLibrary: Loaded 'C:\WINDOWS\System32\KERNEL32.DLL' successfully
2022-11-08T15:12:37.672Z [D] TryLoad succeeded for reference 'kernel32.dll'
2022-11-08T15:12:37.672Z [D] Library class Orc::XmlLiteExtension is not yet loaded
2022-11-08T15:12:37.672Z [D] TryLoad for references 'xmllite.dll'
2022-11-08T15:12:37.672Z [D] ExtensionLibrary: Loading value 'xmllite.dll'
2022-11-08T15:12:37.676Z [D] Opening 'C:\Windows\System32\cmd.exe' for resource 'xmllite.dll' of type 'VALUES'
2022-11-08T15:12:37.677Z [D] Opening 'C:\Windows\explorer.exe' for resource 'xmllite.dll' of type 'VALUES'
2022-11-08T15:12:37.677Z [D] ExtensionLibrary: Loaded 'xmllite.dll' successfully
2022-11-08T15:12:37.677Z [D] ExtensionLibrary: Loaded 'C:\WINDOWS\SYSTEM32\XmlLite.dll' successfully
2022-11-08T15:12:37.677Z [D] TryLoad succeeded for reference 'xmllite.dll'
2022-11-08T15:12:37.719Z [E] Error in specified file '.\tools\handle.exe' to add to archive [0x80070002: Le fichier sp´┐¢cifi´┐¢ est introuvable.]
2022-11-08T15:12:37.719Z [E] Error in specified file '.\tools\Tcpvcon.exe' to add to archive [0x80070002: Le fichier sp´┐¢cifi´┐¢ est introuvable.]
2022-11-08T15:12:37.719Z [E] Error in specified file '.\tools\PsService.exe' to add to archive [0x80070002: Le fichier sp´┐¢cifi´┐¢ est introuvable.]
2022-11-08T15:12:37.719Z [E] Error in specified file '.\tools\Listdlls.exe' to add to archive [0x80070002: Le fichier sp´┐¢cifi´┐¢ est introuvable.]
2022-11-08T15:12:37.719Z [E] Error in specified file '.\tools\DumpIt.exe' to add to archive [0x80070002: Le fichier sp´┐¢cifi´┐¢ est introuvable.]
2022-11-08T15:12:37.719Z [E] Error in specified file '.\tools\winpmem.exe' to add to archive [0x80070002: Le fichier sp´┐¢cifi´┐¢ est introuvable.]
2022-11-08T15:12:37.731Z [I] ** Backtrace End ****
2022-11-08T15:12:37.719Z [C] Failed to parse xml configuration [0x80070002: Le fichier sp´┐¢cifi´┐¢ est introuvable.]
Hello, I am trying to obtain the DFIR-Orc.exe binary but I have some errors. I follow the tutorial ; So I have clonned the dfir-orc-config repository and copy binaries DFIR-ORC_x86.exe and DFIR-ORC_x64.exe in the tools folder. But when I run
I have these errors :
Any advices ? Thank you for your help !