Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mpclient: function at 0x5a741c8a attempted to call an unknown symbol #116

Open
zer0py2c opened this issue Jul 21, 2023 · 7 comments
Open

Comments

@zer0py2c
Copy link

Whats causing this error? :-(

@JEglez
Copy link

JEglez commented Dec 15, 2023

did you find the solution for this? I'm getting the same error

@Gecko05
Copy link

Gecko05 commented Dec 15, 2023

I'm currently facing the same issue, in my case, it seems that the winapi functions are not being set into the crtexports so they remain unknown when the DLL is executed. Noticed that the constructors for these winapi calls are also not being executed somehow, so crtexports.size is 0.
Could we be missing something when compiling or linking? @taviso

@Gecko05
Copy link

Gecko05 commented Dec 16, 2023

Ok I fixed this by following the solution proposed at the end of this thread: https://stackoverflow.com/questions/48212805/why-is-attribute-constructor-in-my-shared-library-not-working

Somehow, when compiling, the constructors for every winapi component are not being linked and thus never executed. So what I did was just append a dummy function at the end of each .c file in winapi and then calling them all somewhere in pe_linker.c.

@Gecko05
Copy link

Gecko05 commented Apr 1, 2024

Gecko05@7225e37
See this commit in my fork to know what I did to compile and run it properly. It's about a bunch of loadSomething methods being called from pe_linker.c

Left some comments on the commit as well.

@OzzyKampha
Copy link

@Gecko05 i tried to use your repo, but i got the same error. Can you try make it in a docker container?

@MrX0r
Copy link

MrX0r commented Apr 29, 2024

@Gecko05
Your repo is getting the same error
./mpclient eicar.com
mpclient: function at 0x5a6aaae8 attempted to call an unknown symbol
Trace/breakpoint trap

exiftool mpengine.dll | grep 'Product Version Number'
Product Version Number : 1.1.24030.4

What could be the reason??

oh yes, in your repo the file CriticalSection.h is missing in the peloader folder

@renini
Copy link

renini commented Nov 16, 2024

Did anyone ever get this to work again on a recent build?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

6 participants