{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4717","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4717/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4717/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4717/events","html_url":"https://github.com/rapid7/metasploit-framework/issues/4717","id":56777132,"number":4717,"title":"GetPC routine is missing for x86/alpha_mixed when using msfvenom","user":{"login":"wchen-r7","id":1170914,"avatar_url":"https://avatars.githubusercontent.com/u/1170914?v=3","gravatar_id":"","url":"https://api.github.com/users/wchen-r7","html_url":"https://github.com/wchen-r7","followers_url":"https://api.github.com/users/wchen-r7/followers","following_url":"https://api.github.com/users/wchen-r7/following{/other_user}","gists_url":"https://api.github.com/users/wchen-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wchen-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wchen-r7/subscriptions","organizations_url":"https://api.github.com/users/wchen-r7/orgs","repos_url":"https://api.github.com/users/wchen-r7/repos","events_url":"https://api.github.com/users/wchen-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wchen-r7/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/bug","name":"bug","color":"e11d21"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/msfvenom","name":"msfvenom","color":"207de5"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-02-06T06:55:54Z","updated_at":"2015-02-06T17:05:30Z","closed_at":null,"body":"I don't have a lot of information at the moment, but to reproduce, first do this:\r\n\r\n```\r\n./msfvenom -p windows/meterpreter/bind_tcp -e x86/alpha_mixed -f raw\r\n```\r\n\r\nYour payload will look like this:\r\n\r\n![screen shot 2015-02-06 at 12 53 31 am](https://cloud.githubusercontent.com/assets/1170914/6075572/9f7a0418-ad9a-11e4-811d-bbdcddbf935a.png)\r\n\r\nBut if you do this with msfpayload and msfencode:\r\n\r\n```\r\n./msfpayload windows/meterpreter/bind_tcp R |./msfencode -e x86/alpha_mixed -t raw\r\n```\r\n\r\nYou will get:\r\n\r\n![screen shot 2015-02-06 at 12 54 17 am](https://cloud.githubusercontent.com/assets/1170914/6075578/c4ebdf14-ad9a-11e4-8dbd-eaab7b749914.png)\r\n\r\nAs you can see, msfpayload/msfencode one contains some non-alphanumeric bytes in the beginning, that's the getpc routine. The one generated by msfvenom doesn't have this.\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/73272725","html_url":"https://github.com/rapid7/metasploit-framework/issues/4717#issuecomment-73272725","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4717","id":73272725,"user":{"login":"wchen-r7","id":1170914,"avatar_url":"https://avatars.githubusercontent.com/u/1170914?v=3","gravatar_id":"","url":"https://api.github.com/users/wchen-r7","html_url":"https://github.com/wchen-r7","followers_url":"https://api.github.com/users/wchen-r7/followers","following_url":"https://api.github.com/users/wchen-r7/following{/other_user}","gists_url":"https://api.github.com/users/wchen-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wchen-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wchen-r7/subscriptions","organizations_url":"https://api.github.com/users/wchen-r7/orgs","repos_url":"https://api.github.com/users/wchen-r7/repos","events_url":"https://api.github.com/users/wchen-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wchen-r7/received_events","type":"User","site_admin":false},"created_at":"2015-02-06T17:05:30Z","updated_at":"2015-02-06T17:05:30Z","body":"It looks like some people are disagree on what the default should be:\r\n\r\nOver here in Msf::Encoder::Alphanum, you can see that AllowWin32SEH is false by default:\r\nhttps://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/encoder/alphanum.rb#L22\r\n\r\nAnd then in the alpha_mixed and alpha_upper encoder modules, they decide to override that by hardcoding AllowWin32SEH to true all the time:\r\nhttps://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/alpha_mixed.rb#L63"}}