(Mar 23, 2020 10:07 PM)SIM-4463207 Wrote:  Codedom, mono.cecil, and dnlib is what ive used for creating new assembly.

(Mar 23, 2020 09:19 PM)Alien Wrote:  I've gone back into an old Launcher project from a few years ago and have decided I'm gonna make it into a fully working project. Basically, the program reads an executable's byte code and runs it in memory. This part is already taken care of and I already have working code for this function. Now what I want to do is, be able to load the .exe via an OpenFileDialog and generate a new executable file that has the loaded .exe as a my.resource within it so that I can drop it without it ever being detected by the user.

I am aware of CodeDom and believe it is most likely the best option to go with, but if anyone has any better ideas/suggestions I am open to them. Thanks. I want to do this the best way possible and to ultimately learn from this project.

(Mar 24, 2020 02:45 PM)StarZ Wrote:  My suggestion is not to drop anything. You can define an assembly and set it's content to execute it via a reflection runpe.


Edit:

Code

   ' thanks to Deathader for the reflection runpe...
   Private Sub RunFromMemory(ByVal bytes As Byte()) 'not sure how it works :(
       Dim assembly As Assembly = assembly.Load(bytes)
       Dim entryPoint As MethodInfo = [assembly].EntryPoint
       Dim objectValue As Object = RuntimeHelpers.GetObjectValue([assembly].CreateInstance(entryPoint.Name))
       entryPoint.Invoke(RuntimeHelpers.GetObjectValue(objectValue), New Object() {New String() {"1"}})
   End Sub

Yoinked from https://hackforums.net/showthread.php?tid=4391216

May have to play around with it to drop detections. But, It works.

(Mar 24, 2020 09:52 PM)BahNahNah Wrote:  What even is that code yikes.
[/code]

(Mar 24, 2020 10:16 PM)Alien Wrote:  The steps still needed to be completed:

1. I need to find a way to have better access to the file.. I thought that dropping it for a brief second, reading it as bytes and then putting it into a variable for later usage (running it through memory), and deleting it, was the best plan. But at this point it seems to chaotic and it may possibly get detected by AV's in the future. Even so, for now this is what I am currently working at unless someone gives me a better idea.

My goal overall:

it needs to be as silent as possible meaning I don't want it to be dropping 10 million files etc. I'd rather most of the work to be done internally within the program if possible.

(Mar 24, 2020 11:19 PM)StarZ Wrote:  Old code yoinked from google. Mainly to show a basic example of the concept in question. Thank you for posting a better solution. 👍

---

Take a look at this old project on github. It shows a lazy way to store the payload. It's far from the best. However it is a viable solution for small payloads.