Wire ARCH_AARCH64 into to_executable_fmt for exe and exe-only#21588
Conversation
to_executable_fmt's 'exe' and 'exe-only' cases were missing ARCH_AARCH64 branches, so msfvenom could not wrap Windows AArch64 payloads (windows/aarch64/exec and future ones) into a PE despite to_winaarch64pe and template_aarch64_windows.exe already existing. Adds 2-line dispatch to to_winaarch64pe in both 'exe' and 'exe-only'.
|
This looks like it is same change as in #21589 - why do you need this PR? |
|
@msutovsky-r7 — they're not duplicates, but I see why it looks that way. #21588 is a strict prerequisite for #21589, and #21589's branch is stacked on top of #21588's commit, so GitHub's diff for #21589 includes both changes (4-line #21588 stands on its own merit even ignoring #21589: Happy to either:
Whichever flow is least friction for you. Let me know. |
There was a problem hiding this comment.
Pull request overview
This PR updates Metasploit’s executable format dispatcher (Msf::Util::EXE::ClassMethods#to_executable_fmt) so Windows AArch64 payloads can be wrapped as Windows executables via -f exe and -f exe-only, by routing ARCH_AARCH64 to the existing to_winaarch64pe helper.
Changes:
- Add an
ARCH_AARCH64branch to the'exe'format case, dispatching toto_winaarch64pe. - Add an
ARCH_AARCH64branch to the'exe-only'format case (currently also dispatching toto_winaarch64pe).
Impact Analysis:
- Blast radius: medium; affects msfvenom/framework consumers that generate Windows executables via
to_executable_fmt, but only whenarch == ARCH_AARCH64and format isexe/exe-only. - Data and contract effects: changes output contract from
nilto a generated PE for AArch64 in these formats; no schema/storage changes. - Rollback and test focus: easy rollback (single-file change); validate
msfvenom -f exeand-f exe-onlyfor AArch64 (including-xcustom template behavior forexe-only) and ensure x86/x64 paths remain unchanged.
| when ARCH_AARCH64 | ||
| to_winaarch64pe(framework, code, exeopts) |
There was a problem hiding this comment.
Fixed in 580d45f. Folded ARCH_X64 and ARCH_AARCH64 into one when branch since they make the same to_winpe_only(framework, code, exeopts, arch) call, matching the x64 path so -f exe-only -x <user.exe> injects via PE-section surgery instead of failing on the PAYLOAD: tag lookup.
to_winaarch64pe is the wrapper helper for the 'exe' format -- it requires the default template_aarch64_windows.exe which contains a literal PAYLOAD: placeholder, and aborts with "Invalid Windows AArch64 template: missing \"PAYLOAD:\" tag" on any other PE. That breaks the whole purpose of 'exe-only', which exists to support user-supplied PE templates via msfvenom -x. The x64 path correctly dispatches to to_winpe_only(framework, code, exeopts, arch), which does PE-section surgery and works on arbitrary PEs. Wire ARCH_AARCH64 through the same to_winpe_only call. Caught by GitHub Copilot review. Co-authored-by: Cursor <cursoragent@cursor.com>
Align to_winaarch64pe call with surrounding to_win32pe/to_win64pe branches. Caught by GitHub Copilot review. Co-authored-by: Cursor <cursoragent@cursor.com>
Release NotesFix a bug in the format dispatcher where although we can generate AARCH64 windows exe files, we fail trying to do so because the dispatcher does not properly handle the request by the user. |
|
I removed the |

Wire ARCH_AARCH64 into
to_executable_fmtforexeandexe-onlyformatsSummary
Msf::Util::EXE::ClassMethods#to_executable_fmtis missingARCH_AARCH64branches in its
'exe'and'exe-only'cases. The helperto_winaarch64pe(inlib/msf/util/exe/windows/aarch64.rb) is fullyimplemented and the corresponding template
(
data/templates/template_aarch64_windows.exe) ships with theframework, but neither is reachable from msfvenom today because the
format dispatcher silently falls through when arch is AArch64 and
returns
nil.This means the existing
windows/aarch64/execpayload — and any futureWindows AArch64 payload — cannot be wrapped into a PE via msfvenom:
Fix
Add the missing
when ARCH_AARCH64branches to both'exe'and'exe-only'cases, dispatching to the already-existingto_winaarch64pehelper:Same two-line addition for
'exe-only'. No other code paths touched.Verification
Before this PR:
After this PR:
The resulting PE was executed on Windows 11 ARM64 (build 26200) and
correctly launched
calc.exe.-f raw,-f c,-f hex, and-f binalready worked because they donot go through the EXE wrapper. This PR makes
-f exeand-f exe-onlycatch up to the same support level.
Test plan
./msfvenom -p windows/aarch64/exec CMD=calc.exe -f exe -o exec.exesucceedsfile exec.exereports a PE32+ AArch64 console executableexec.exeruns and launchescalc.exeon a Windows 11 ARM64 machine./msfvenom -p windows/aarch64/exec CMD=calc.exe -f exe-only -o exec_only.exesucceeds-f exe/-f exe-onlypaths are unaffected (regression check)