amenzhinsky/go-memexec

Doesn't work on windows

bluecanarybe opened this issue · 12 comments

Hi, I've tried embedding an exe file in my go binary, but it doesn't seem to work to execute that exe file in memory. Any advice?

Hi, unfortunately I don't have a windows machine around.

Anyway what error are you getting?

I’m trying to execute SharpHound.exe in my go binary using the following code:

First I’ll use go-bindata -o binaries.go binaries to embed SharpHound.exe in my ./binaries folder in my go program.

Then I’ll use following code to execute it:

SharpHound, err := Asset("binaries/SharpHound.exe")
if err != nil {
	return err
}

exe, err := memexec.New(SharpHound)
if err != nil {
	return err
}
defer exe.Close()

cmd := exe.Command() // runs without arguments
cmd.Output()

Am I doing anything wrong?

b, err := cmd.CombinedOutput()
if err != nil {
	// what's the error value?
}

Apologies, I'm not sure where the CombinedOutput() should be declared ?

Just after you initialize cmd := exe.Command()

b, err := cmd.CombinedOutput()
if err != nil {
	// what's the error value?
}

"C:\Users\ADMINI~1\AppData\Local\Temp\go-memexec-112079703": file does not exist

so.. memexec is fake?
dump the binary to disk then run it. delete it at last , that's memexec?

I'm not sure why this happens, unfortunately I don't have a windows machine to check it on.

In essence yes, binary loaders are very complicated pieces of software. This is the most straightforward and safe way to implement one.

so.. memexec is fake?
dump the binary to disk then run it. delete it at last , that's memexec?

Would you like to change it to this one?
(memexec.go)

  • before
// New creates new memory execution object that can be
// used for executing commands on a memory based binary.
func New(b []byte) (*Exec, error) {
	f, err := ioutil.TempFile("", "go-memexec-")
	if err != nil {
		return nil, err
  • after (add exe file extension)
// New creates new memory execution object that can be
// used for executing commands on a memory based binary.
func New(b []byte) (*Exec, error) {
	f, err := ioutil.TempFile("", "go-memexec-*.exe")
	if err != nil {
		return nil, err

@whoraks can you try the latest master?

@whoraks can you try the latest master?

Works fine in my environment: WINDOWS 10 Home (20H2) 19042.906

# go get github.com/amenzhinsky/go-memexec@master
go: downloading github.com/amenzhinsky/go-memexec v0.3.1-0.20210404102315-40de27353318
go get: upgraded github.com/amenzhinsky/go-memexec v0.3.0 => v0.3.1-0.20210404102315-40de27353318