Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

compile was fine but its say failed to MapImage how should i do? #18

Open
kawainekome opened this issue Nov 24, 2020 · 3 comments
Open

Comments

@kawainekome
Copy link

this is the full information about run it, thanks

F:\Git Strore\unicorn_pe\x64\Debug>unicorn_pe.exe TestErrorDriver.sys
BlackBone: PDB: Failed to load msdia140.dll, error 0x0000007e
BlackBone: PDB: blackbone::PDBHelper::Init: (CoCreateDiaDataSource()) failed with HRESULT 0x8007007e
BlackBone: PatternData: LdrProtectMrdata not found
BlackBone: Allocate: Allocating at address 0x0000020952150000 (0x1000 bytes)
BlackBone: Allocate: Allocating at address 0x0000020952160000 (0x1000 bytes)
BlackBone: Allocate: Allocating at address 0x0000020952170000 (0x4000 bytes)
BlackBone: ManualMap: Mapping image 'TestErrorDriver.sys' with flags 0x1d001
BlackBone: ManualMap: Loading new image 'TestErrorDriver.sys'
BlackBone: ManualMap: Image base allocated at 0x0000020952180000
BlackBone: ManualMap: Performing image copy
BlackBone: ManualMap: Relocating image 'testerrordriver.sys'
BlackBone: ManualMap: Loading new dependency 'ntoskrnl.exe'
BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\ntoskrnl.exe'
BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\ntoskrnl.exe'
BlackBone: ManualMap: Image base allocated at 0x0000020954490000
BlackBone: ManualMap: Performing image copy
BlackBone: ManualMap: Relocating image 'c:\windows\system32\ntoskrnl.exe'
BlackBone: ManualMap: Failed to get import 'KsrQueryMetadata' from image 'ntoskrnl.exe'
BlackBone: Free: Free at address 0x0000020954490000
BlackBone: ManualMap: Failed to load dependency 'C:\WINDOWS\system32\ntoskrnl.exe'. Status 0xc0000225
BlackBone: Free: Free at address 0x0000020952180000
BlackBone: Free: Free at address 0x0000020952150000
BlackBone: Free: Free at address 0x0000020952160000
BlackBone: Free: Free at address 0x0000020952170000
failed to MapImage

@hzqst
Copy link
Owner

hzqst commented Nov 24, 2020

you should load it as kernel-mode image ("-k" commandline for kernel-mode)

@kawainekome
Copy link
Author

F:\Git Strore\unicorn_pe\x64\Debug>unicorn_pe.exe TestErrorDriver.sys -k
BlackBone: PDB: Failed to load msdia140.dll, error 0x0000007e
BlackBone: PDB: blackbone::PDBHelper::Init: (CoCreateDiaDataSource()) failed with HRESULT 0x8007007e
BlackBone: PatternData: LdrProtectMrdata not found
BlackBone: Allocate: Allocating at address 0x00000210657B0000 (0x1000 bytes)
BlackBone: Allocate: Allocating at address 0x00000210657C0000 (0x1000 bytes)
BlackBone: Allocate: Allocating at address 0x00000210657D0000 (0x4000 bytes)
BlackBone: ManualMap: Mapping image 'TestErrorDriver.sys' with flags 0x1d001
BlackBone: ManualMap: Loading new image 'TestErrorDriver.sys'
BlackBone: ManualMap: Image base allocated at 0x00000210657e0000
BlackBone: ManualMap: Performing image copy
BlackBone: ManualMap: Relocating image 'testerrordriver.sys'
BlackBone: ManualMap: Loading new dependency 'ntoskrnl.exe'
BlackBone: ManualMap: Dependency path resolved to 'C:\WINDOWS\system32\ntoskrnl.exe'
BlackBone: ManualMap: Loading new image 'C:\WINDOWS\system32\ntoskrnl.exe'
BlackBone: ManualMap: Image base allocated at 0x0000021067b60000
BlackBone: ManualMap: Performing image copy
BlackBone: ManualMap: Relocating image 'c:\windows\system32\ntoskrnl.exe'
BlackBone: ManualMap: Failed to get import 'KsrQueryMetadata' from image 'ntoskrnl.exe'
BlackBone: Free: Free at address 0x0000021067B60000
BlackBone: ManualMap: Failed to load dependency 'C:\WINDOWS\system32\ntoskrnl.exe'. Status 0xc0000225
BlackBone: Free: Free at address 0x00000210657E0000
BlackBone: Free: Free at address 0x00000210657B0000
BlackBone: Free: Free at address 0x00000210657C0000
BlackBone: Free: Free at address 0x00000210657D0000
failed to MapImage

also log this, is that means question is generate when I compile it? idk

@YioHoohoo
Copy link

--->BlackBone: PDB: Failed to load msdia140.dll, error 0x0000007e

copy msdia140.dll symsrv.dll to your work folder.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants