TheWover / donut

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters
BSD 3-Clause "New" or "Revised" License
3.53k stars 628 forks source link

Relocation information error v0.9.3 with Cobalt Strike v4.1 #59

Closed invictus-0x90 closed 4 years ago

invictus-0x90 commented 4 years ago

As discussed on slack, with donut v0.9.3 it is not possible to generate shellcode from a Cobalt Strike exe. CS 4.1 was used, 32 and 64 bit exes were generated, and on running donut the following error occured: [ Error : This file has no relocation information required for in-memory execution.

However, with v0.9.2 the shellcode generation is successful. Possible root cause "I think we added the check for reloc information in v0.9.3"

Thanks for the help!