You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
when you have a moment, could you have a look at below.
I tried to use your tool to generate some DLL and sign them. Here are my results:
python inceptor.py native c:\repos\msgbox32.raw --arch x86 -o cldapi.dll
Does not work. The exported function is called _PsychoBlastEP@16 and it cannot be called successfully.
python inceptor.py native c:\repos\msgbox64.raw --arch x64 -o cldapi.dll
Works perfectly.
python inceptor.py native c:\repos\msgbox64.raw --arch x64 -o cldapi.dll -e XOR
Does not work.
python inceptor.py native c:\repos\msgbox64.raw --arch x64 -o cldapi.dll -s -sd microsoft.com -so
Works but it is not signed.
python inceptor.py native c:\repos\msgbox64.raw --arch x64 -o cldapi.dll -s -sd www.microsoft.com
Works and it is signed.
python inceptor.py native c:\repos\msgbox64.raw --arch x64 -o cldapi.dll --clone C:\Windows\system32\ntdll.dll
Does not work. Breaks the DLL. The output DLL has all exported functions from ntdll.dll.
Any chance for fixing them, please? :)
thanks
Rafal
The text was updated successfully, but these errors were encountered:
Hi @0xElessar, thanks for the continous testing, it is very precious.
So, let's come to your points one by one:
Oflline signing: Should be fixed in dev branch
x86 Exports: You should define an export file .def if you want to prevent names from being mangled by the linker.
--clone standard behaviour is to copy everything from a binary. If you want just the metadata like "company, copyright, etc" there is no support for that, but there will be in the near future, so stay tuned.
XOR not working, what do you mean with that exactly?
I will try to define .def file then. I remember having problems with it in the past. But i will try again.
Do you have any suggestion how to use --clone function effectively? In my testing, my payloads were overwritten by this function.
When I use an encoder with the DLL, there is no error message during DLL generation, but the payload seems to be damaged. Even a simple payload with a message box does not work after using an encoder. Without an encoder, the payload is executed successfully.
Hey @klezVirus ,
when you have a moment, could you have a look at below.
I tried to use your tool to generate some DLL and sign them. Here are my results:
python inceptor.py native c:\repos\msgbox32.raw --arch x86 -o cldapi.dll
Does not work. The exported function is called _PsychoBlastEP@16 and it cannot be called successfully.
python inceptor.py native c:\repos\msgbox64.raw --arch x64 -o cldapi.dll
Works perfectly.
python inceptor.py native c:\repos\msgbox64.raw --arch x64 -o cldapi.dll -e XOR
Does not work.
python inceptor.py native c:\repos\msgbox64.raw --arch x64 -o cldapi.dll -s -sd microsoft.com -so
Works but it is not signed.
python inceptor.py native c:\repos\msgbox64.raw --arch x64 -o cldapi.dll -s -sd www.microsoft.com
Works and it is signed.
python inceptor.py native c:\repos\msgbox64.raw --arch x64 -o cldapi.dll --clone C:\Windows\system32\ntdll.dll
Does not work. Breaks the DLL. The output DLL has all exported functions from ntdll.dll.
Any chance for fixing them, please? :)
thanks
Rafal
The text was updated successfully, but these errors were encountered: