Skip to content

Conversation

@tbaker57
Copy link
Contributor

@tbaker57 tbaker57 commented Dec 4, 2024

Adding the standalone tool WFMFormat.exe which is extracted from the Messaging Farm Analyzer download https://www.microsoft.com/en-us/download/details.aspx?id=103244.

This is a signed .NET executable for parsing dumpfiles produced by one of the other tools in this download and the decompiled picture paints a thousand words:

WFMFormat

The easiest way to exploit this is to copy your target executable to a file called 'tracerpt.exe' in the same directory as WFMFormat.exe, and then create a file 'dumpfile.txt' in the same directory. Executing WFMFormat.exe with no args will then spawn 'tracerpt.exe dumpfile.txt -y'

Copy link
Member

@wietze wietze left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice find! I have made a few small changes:

  • Also works on Windows 11
  • ... but requires .NET Framework 3.5. Especially on modern Windows, this is quite a limitation.
  • tracerpt.exe has to be in the same folder as WFMFormat.exe, whereas dumpfile.txt should be in the current working directory.

Thanks for your contribution.

@wietze wietze merged commit f20158d into LOLBAS-Project:master Feb 15, 2025
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants