From ef62d251feb2afbdf0fd8bf344f2a54316cea021 Mon Sep 17 00:00:00 2001 From: vinicius-batistella Date: Fri, 19 Jun 2026 23:06:17 -0300 Subject: [PATCH 1/3] Wire ARCH_AARCH64 into to_executable_fmt for exe formats to_executable_fmt's 'exe' and 'exe-only' cases were missing ARCH_AARCH64 branches, so msfvenom could not wrap Windows AArch64 payloads (windows/aarch64/exec and future ones) into a PE despite to_winaarch64pe and template_aarch64_windows.exe already existing. Adds 2-line dispatch to to_winaarch64pe in both 'exe' and 'exe-only'. --- lib/msf/util/exe.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb index 5e01700639f2f..88f274d31db9c 100644 --- a/lib/msf/util/exe.rb +++ b/lib/msf/util/exe.rb @@ -135,6 +135,8 @@ def to_executable_fmt(framework, arch, plat, code, fmt, exeopts) to_win32pe(framework, code, exeopts) when ARCH_X64 to_win64pe(framework, code, exeopts) + when ARCH_AARCH64 + to_winaarch64pe(framework, code, exeopts) end when 'exe-service' case arch @@ -156,6 +158,8 @@ def to_executable_fmt(framework, arch, plat, code, fmt, exeopts) to_winpe_only(framework, code, exeopts) when ARCH_X64 to_winpe_only(framework, code, exeopts, arch) + when ARCH_AARCH64 + to_winaarch64pe(framework, code, exeopts) end when 'msi' case arch From 580d45f929a7a9b68310b56325dd662ccb466629 Mon Sep 17 00:00:00 2001 From: vinicius-batistella Date: Thu, 25 Jun 2026 19:33:31 -0300 Subject: [PATCH 2/3] Dispatch 'exe-only' AArch64 to to_winpe_only, not to_winaarch64pe to_winaarch64pe is the wrapper helper for the 'exe' format -- it requires the default template_aarch64_windows.exe which contains a literal PAYLOAD: placeholder, and aborts with "Invalid Windows AArch64 template: missing \"PAYLOAD:\" tag" on any other PE. That breaks the whole purpose of 'exe-only', which exists to support user-supplied PE templates via msfvenom -x. The x64 path correctly dispatches to to_winpe_only(framework, code, exeopts, arch), which does PE-section surgery and works on arbitrary PEs. Wire ARCH_AARCH64 through the same to_winpe_only call. Caught by GitHub Copilot review. Co-authored-by: Cursor --- lib/msf/util/exe.rb | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb index 88f274d31db9c..7f03726157fa6 100644 --- a/lib/msf/util/exe.rb +++ b/lib/msf/util/exe.rb @@ -156,10 +156,8 @@ def to_executable_fmt(framework, arch, plat, code, fmt, exeopts) case arch when ARCH_X86, nil to_winpe_only(framework, code, exeopts) - when ARCH_X64 + when ARCH_X64, ARCH_AARCH64 to_winpe_only(framework, code, exeopts, arch) - when ARCH_AARCH64 - to_winaarch64pe(framework, code, exeopts) end when 'msi' case arch From 8ece67966ae8a05e3184872d75b9539ab11a7757 Mon Sep 17 00:00:00 2001 From: vinicius-batistella Date: Thu, 25 Jun 2026 20:07:52 -0300 Subject: [PATCH 3/3] Fix ARCH_AARCH64 branch indentation in 'exe' dispatcher Align to_winaarch64pe call with surrounding to_win32pe/to_win64pe branches. Caught by GitHub Copilot review. Co-authored-by: Cursor --- lib/msf/util/exe.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb index 7f03726157fa6..1e3f2ce930383 100644 --- a/lib/msf/util/exe.rb +++ b/lib/msf/util/exe.rb @@ -136,7 +136,7 @@ def to_executable_fmt(framework, arch, plat, code, fmt, exeopts) when ARCH_X64 to_win64pe(framework, code, exeopts) when ARCH_AARCH64 - to_winaarch64pe(framework, code, exeopts) + to_winaarch64pe(framework, code, exeopts) end when 'exe-service' case arch