+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] ManagedRunPE | RunPE substitute for .NET assemblies (/showthread.php?tid=5800227)
ManagedRunPE | RunPE substitute for .NET assemblies - gigajew - Feb 15, 2018
Here's my managed alternative to a RunPE. Works with x86->AnyCPU/x86 and x64->AnyCPU/x86/x64. It fully supports parameters and GUI applications. It's not going to follow any particular coding conventions so don't even mention it. It runs fine. It checks whether the assembly is actually managed or not before trying to load it. The Inject method returns a Boolean value indicating success or failure.
Usage:
Code
ManagedRunPE.Inject(byte[] buffer, bool emptybuffer, params string[] arguments);Source code:
RE: ManagedRunPE | RunPE substitute for .NET assemblies - Scapula™ - Feb 17, 2018
Good work gigajew and thx for your contribution to the .Net section.
RE: ManagedRunPE | RunPE substitute for .NET assemblies - mundi_86 - Feb 19, 2018
great work, thx 4 sharing the code with us.
i will play with it :)
RE: ManagedRunPE | RunPE substitute for .NET assemblies - gigajew - Feb 20, 2018
Added detection for MTAThread/STAThread and implemented RtlZeroMemory(); to delete header in memory, added some null calls and garbagecollector collection
RE: ManagedRunPE | RunPE substitute for .NET assemblies - novak80 - Feb 22, 2018
I'm not an expert at RunPE or C# for that matter, but I have a question - does this inject the executable from which it was run into another executable, or the other way around? Or should I word it differently....does this code go into what we want to inject, or another process that is supposed to seem "legit"?
RE: ManagedRunPE | RunPE substitute for .NET assemblies - gigajew - Feb 22, 2018
(Feb 22, 2018 04:00 PM)novak80 Wrote: I'm not an expert at RunPE or C# for that matter, but I have a question - does this inject the executable from which it was run into another executable, or the other way around? Or should I word it differently....does this code go into what we want to inject, or another process that is supposed to seem "legit"?
It basically just loads the assembly from a byte array and invokes the entrypoint method
RE: ManagedRunPE | RunPE substitute for .NET assemblies - gigajew - Mar 4, 2018
Updated and refactored code, clears memory properly & asynchronously invokes
Not compatible with Quasar at the moment
RE: ManagedRunPE | RunPE substitute for .NET assemblies - subtilebestia - Mar 13, 2018
Thanks for your effort. Tested it and looks good.