search

optiv / ScareCrow

ScareCrow - Payload creation framework designed around EDR bypass.
2.71k stars 503 forks source link

'.exp' files are not the compiled Go files #63

Closed vysecurity closed 2 years ago

vysecurity commented 2 years ago

I noticed the .exp files generated are not the same as the go files on disk.

E.g. it always compiles the original .go file and doesn't compile the changed / modified code?

vysecurity commented 2 years ago

What is the logic behind hardcoding a base64 encoded zip file into the loader?

Tylous commented 2 years ago

This is closed, are all your questions answered? If note, the base64 encoded zip is not in the loader its in the framework of Scarecrow to help generate loaders without the need for all the subfolders and whatnot. As for your first question I am not tracking can you elaborate.

vysecurity commented 2 years ago

Hey Tylous. It's alright, figured it out.