Kudaes-Puzzle/IdMapper/README.md

IdMapper

IdMapper opens a file by its FRN (File Reference Number) and executes it without using its path. It is intended to be used after creating a bindlink, as described in the BindLinks documentation.

The tool asks for:

• Mode: spawn to create a new process from the mapped section, or load to map the PE in the current process and jump to its entry point.
• Volume: Drive letter, for example C.
• FRN: File Reference Number in hexadecimal format.

Usage

C:\Path\To\Puzzle\bin> id_mapper.exe
Select mode (spawn/load): spawn
Select volume (e.g. 'C'): C
Insert FRN: 0x000300000019fa17