abdullah2993 / go-runpe Goto Github PK

C:\Repositories\go-runpe>go run cmd\exec\main.go
Creating process: C:\Windows\System32\calc.exe
Process created. Process: 364, Thread: 352
Getting thread context of 352
GetThreadContext[352]: [1] The operation completed successfully.
Address to PEB[Rdx]: a37a82f000
ReadProcessMemory[364 : a37a82f010]: [1] The operation completed successfully.
ReadProcessMemoryAsAddr[364 : a37a82f010]: [7ff771710000] <nil>
Base Address of Source Image from PEB[ImageBaseAddress]: 7ff771710000
Reading destination PE
Getting OptionalHeader of destination PE
ImageBase of destination PE[OptionalHeader.ImageBase]: 140000000
Unmapping view of section 7ff771710000
NtUnmapViewOfSection[364 : 7ff771710000]: [0] The operation completed successfully.
Allocating memory in process at 7ff771710000 (size: 233472)
VirtualAllocEx[364 : 7ff771710000]: [140700736880640] The operation completed successfully.
New base address 7ff771710000
Writing PE to memory in process at 7ff771710000 (size: 1024)
WriteProcessMemory[364 : 7ff771710000]: [1] The operation completed successfully.
Writing section[.text] to memory at 7ff771711000 (size: 155136)
WriteProcessMemory[364 : 7ff771711000]: [1] The operation completed successfully.
Writing section[.rdata] to memory at 7ff771737000 (size: 39424)
WriteProcessMemory[364 : 7ff771737000]: [1] The operation completed successfully.
Writing section[.data] to memory at 7ff771741000 (size: 3584)
WriteProcessMemory[364 : 7ff771741000]: [1] The operation completed successfully.
Writing section[.pdata] to memory at 7ff771744000 (size: 4608)
WriteProcessMemory[364 : 7ff771744000]: [1] The operation completed successfully.
Writing section[.didat] to memory at 7ff771746000 (size: 512)
WriteProcessMemory[364 : 7ff771746000]: [1] The operation completed successfully.
Writing section[.rsrc] to memory at 7ff771747000 (size: 3072)
WriteProcessMemory[364 : 7ff771747000]: [1] The operation completed successfully.
Writing section[.reloc] to memory at 7ff771748000 (size: 1024)
WriteProcessMemory[364 : 7ff771748000]: [1] The operation completed successfully.
Calcuating relocation delta
Relocation delta: -140695368171520
Writing new ImageBase to Rdx 7ff771710000
WriteProcessMemory[364 : a37a82f010]: [1] The operation completed successfully.
Setting new entrypoint to Rcx 7ff771735410
Setting thread context 352
SetThreadContext[352]: [1] The operation completed successfully.
Resuming thread 352
ResumeThread[352]: [1] The operation completed successfully.

C:\Repositories\go-runpe>