search

hasherezade / pe_to_shellcode

Converts PE into a shellcode
https://www.youtube.com/watch?v=WQCiM0X11TA
BSD 2-Clause "Simplified" License
2.27k stars 423 forks source link

runshc.exe different size end compile #15

Closed johnjohnsp1 closed 3 years ago

johnjohnsp1 commented 3 years ago

not really an issue but a question: both compiled script with the code you provided as pe2sh.exe and runshc.exe i see have a different size of the same files you provided as releases. i did compile with: Microsoft Visual Studio Enterprise 2019 Version 16.8.2 VisualStudio.16.Release/16.8.2+30717.126 Microsoft .NET Framework Version 4.8.04084 Installed Version: Enterprise Visual C++ 2019 00433-90000-00004-AA023 Microsoft Visual C++ 2019 ASP.NET and Web Tools 2019 16.8.553.28003 ASP.NET and Web Tools 2019 ASP.NET Core Razor Language Services 16.1.0.2052803+84e121f1403378489b842e1797df2f3f5a49ac3c Provides languages services for ASP.NET Core Razor. Azure App Service Tools v3.0.0 16.8.553.28003 Azure App Service Tools v3.0.0 C# Tools 3.8.0-5.20567.16+53c5d7d3cf13d88978744a32a27c5f8350a8400a C# components used in the IDE. Depending on your project type and settings, a different version of the compiler may be used. GitHub.VisualStudio 2.11.106.19330 A Visual Studio Extension that brings the GitHub Flow into Visual Studio. IntelliCode Extension 1.0 IntelliCode Visual Studio Extension Detailed Info Microsoft JVM Debugger 1.0 Provides support for connecting the Visual Studio debugger to JDWP compatible Java Virtual Machines Microsoft Library Manager 2.1.113+g422d40002e.RR Install client-side libraries easily to any web project Microsoft MI-Based Debugger 1.0 Provides support for connecting Visual Studio to MI compatible debuggers Microsoft Visual C++ Wizards 1.0 Microsoft Visual C++ Wizards Microsoft Visual Studio Tools for Containers 1.1 Develop, run, validate your ASP.NET Core applications in the target environment. F5 your application directly into a container with debugging, or CTRL + F5 to edit & refresh your app without having to rebuild the container. Microsoft Visual Studio VC Package 1.0 Microsoft Visual Studio VC Package NuGet Package Manager 5.8.0 NuGet Package Manager in Visual Studio. For more information about NuGet, visit https://docs.nuget.org/ ProjectServicesPackage Extension 1.0 ProjectServicesPackage Visual Studio Extension Detailed Info Visual Studio Code Debug Adapter Host Package 1.0 Interop layer for hosting Visual Studio Code debug adapters in Visual Studio Visual Studio Container Tools Extensions 1.0 View, manage, and diagnose containers within Visual Studio. Visual Studio Tools for CMake 1.0 Visual Studio Tools for CMake Visual Studio Tools for Containers 1.0 Visual Studio Tools for Containers

them both are working within my machine but once i try to execute them in a different machine a messagebox (see attachment) msvcp140d_dll ucrtbased vcruntime140d_dll

your same files downloaded runsch64.exe have different size than mine and working just as good as expected:

my file compiled: Mode LastWriteTime Length Name

-a---- 12/8/2020 4:16 PM 89600 runshc.exe

your file downloaded: Mode LastWriteTime Length Name

-a---- 8/13/2020 1:19 PM 264192 runshc64.exe

i do something wrong ? can't figure out why different size.. thanks

hasherezade commented 3 years ago

Hi! I see you compiled them in a Debug mode. The DLLs with a version with 'd" suffix (i.e. VCRUNTIME140D.dll) are used when the app is compiled in a debug mode. This may also significantly increase the size of the generated binary. Try to compile in the Release mode.

release_mode

johnjohnsp1 commented 3 years ago

Hi, thanks for the fast reply, i did compile in the release mode and i see the size is smaller than debug: -a---- 12/8/2020 5:38 PM 55808 runshc.exe

confirmed is also working in a different machine as well ! thanks !