search

Xacone / BestEdrOfTheMarket

Little user-mode AV/EDR evasion lab for training & learning purposes
https://xacone.github.io/BestEdrOfTheMarketV2.html
MIT License
947 stars 103 forks source link

Build Errors #15

Closed melid404 closed 2 months ago

melid404 commented 2 months ago

Hi,

I am trying to build the BEOTM for some training purposes, however after installing vcpck packages on setup.md and cloning the repo using VS 2022, building throws 2 errors and 70 warnings:

Error | C4996 | 'localtime': This function or variable may be unsafe. Consider using localtime_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. | BestEdrOfTheMarket | 

Error | C1083 | Cannot open include file: 'json/json.h': No such file or directory | BestEdrOfTheMarket |

Thanks for the great project, surely it will be helpful for me to learn about EDR bypasses.

Xacone commented 2 months ago

Hello,

Fixed the localtime problem there -> https://github.com/Xacone/BestEdrOfTheMarket/commit/3c8c31908b936f8b6379b1c0aaa26a8c3249e0d6

Regarding the missing header problem, once you've done vcpkg install jsoncpp within the project directory, ensure that vcpkg list shows you that jsoncpp was indeed installed :

PS C:\BestEdrOfTheMarket> .\vcpkg\vcpkg.exe list
jsoncpp:x64-windows        1.9.5#4        JsonCpp is a C++ library that allows manipulatin...

If it was sucessfully installed, jsoncpp's libs + headers files should be placed in your $HOME\vcpkg\installed\x64-windows\, link them statically if they where not linked to the projet (and let me know about it). I also added the jsoncpp.dll in the sources just in case.

Could you also try to build BEOTM in its Release configuration ? Thanks & let me know how the build going.

Xacone commented 2 months ago

Note that the same should be done with the YARA dependency. Kind of weird that you did not encounter the same problem with it.

melid404 commented 2 months ago

Hi,

Sorry for the late reply. The localtime issue has been resolved with the latest update. Other include errors are gone after proper installation of vcpck (specifically integrate install command).

It is now all good and working fine.

Thank you.