Unresolved external in nanodump.x64.o
kulinacs opened this issue · comments
nanodump.x64.o cannot be used with "friendly" COFF loaders (like Cobalt Strike) due to implementations for get_library_address and get_function_address not being provided. A quick fix for this is provided below, although it imports a decent chunk of code that is unused and is not an ideal solution.
tl;dr - as these functions are built without an implementation, the compiler treats them as external functions. When a COFF loader sees this, it will attempt to resolve an implementation externally, which it can't.
diff --git a/source/entry.c b/source/entry.c
index 323c2af..e37d62e 100644
--- a/source/entry.c
+++ b/source/entry.c
@@ -1,6 +1,8 @@
#include "entry.h"
#ifdef BOF
+ #include "syscalls.h"
+ #include "dinvoke.c"
#include "nanodump.c"
#else
#include "nanodump.h"
Woops, you are right, seems like nanodump.x64.o is broken, thanks for reporting!
I will fix it soon
Ok that should be it, let me know if it still fails, thanks again for the issue 😄