Memory Base Allocation about blobrunner HOT 8 CLOSED

Thanks @itripc taking a look.

from blobrunner.

Appreciated idiom

from blobrunner.

Tested and this works as expected. Can you try the following

1. Run:
   bloblrunner.exe shellcode3_actual_meterpreter.bin

This will display the offset of the allocated memory. Example:

[*] Entry: 0x000c0000

2. Open your debugger and attach to the blobrunner.exe process.
3. Navigate to the above address (ctrl-g if you are using x64dbg) and set a breakpoint (f2)
   In your sample this should be

FC                       cld          ;  <-- Add Breakpoint here
E8 82 00 00      call C0088
60                       pushad

4 Resume the process in the debugger.
5. Now press enter in the Blobrunner console window to resume execution.

This will break at the first instruction of the loaded shellcode where you placed the breakpoint.

from blobrunner.

@itripc Also here is a short video explaining using it - https://www.youtube.com/watch?v=q9q8dy-2Jeg

from blobrunner.

Funny I was using x64dbg and it seemed to work fine in x64 but the issue was with IDA remote dbg, I couldnt get the offset to line up in segments. The video is great watched it yesterday thanks.

from blobrunner.

Hey, I just tested with Ida - remote debugging and it should also work using the same method as above. When you navigate to the offset, you will need to convert it to code and then set the breakpoint, the shellcode should be written to the start of the allocated region.

Are you seeing it written at the end?

Here is an example where I renamed the region to shellcode and have it set as executable.

from blobrunner.

from blobrunner.

Great! If you have any questions feel free to reach out

from blobrunner.