[Only3]

You are right, but loading in another appdomain would be better ;)

yes so u can just unload it when u finish
😁 menalix i knew somthing like this will come
Convert to pdf the microsoft pe docx https://mega.co.nz/#fm/HoFWgZDA

[intrinsic]

Since when can you inject x86 code into a x64 environment?

[intrinsic]

Well because it was only to make an example on how this works, and if someone tryed to reverse it, it would be kinda useless to their crypter.
My example uses NtGetProcessInformation instead of GetThreadContext, as I don't want to share CONTEXT_AMD64 it's a really baddy converting.
And that the cool about a RunPE is injecting other exe's and not loading into your own app domain.

---

Has always been possible in .NET
Because .NET files is compiled at runtime, so the code is first run into 64bit or 32bit at runtime, and it's pretty obvious seen with the AnyCPU compile option.
Did you think .NET could be compiled into both on the same time? And why does no native languages have that option.

It's not possible with both assemblies being compiled as x64 and x86.

.NET assemblies that are compiled with constant architectures have constant registers and datatypes.

Good try though, really.
If this is only for .NET why not just use Assembly.Load?

Also there is no such thing as "NtGetProcessInformation"
NtQueryInformationProcess is what you're looking for. All you're doing is changing the imagebase.
https://hackforums.net/showthread.php?tid=4424517

[Unturned]

I'm stupid enough to understand this tut, it allows inject or read teh source code inside?

[intrinsic]

Try my Injector yourself, and you'll be prooven wrong, there's a reason I uploaded it.
If you're to lazy look on my old video: https://www.youtube.com/watch?v=k2pLF56gXXw

Cause Assembly.Load only works for the calling application.

Yea I misspelled the API, good find (y)
Nope that's not the only thing I do, pretty much AeonHacks RunPE states everything I do and any other public RunPE.

First of all, do you know what a codecave is?
Secondly, you don't even know the name of the API you're using. It's not a 'misspell'.

You can't inject x86->x64 without performing heavens gate.

---

Anyone that suggested to use Assembly.Load instead, hasn't taken obfuscated applications into account.

Yeah because people are going to encrypt their already obfuscated file.
A packed executable should work just fine as long as there is nothing being dropped or relocated.

[intrinsic]

Yes i know what code cave is..... Which has nothing to do with this, with a RunPE we simply don't let the exe load finish, and overwrites it's data with ours, simply put.

It was a misspell idiot, I was answering from my iPhone when I was with my GF answering, and wrote "Get" instead of "Query", get over it dude, how the hell would even make my injector work if I declared a wrong API name.

Just try my injector if you don't believe me, how can it be so hard?

If you knew what a codecave was you wouldn't have brought up the problem for 'assembly.load being only available on the calling application' How does loadlibrary work? you utter and complete retard.

'with a runpe we simply don't let the exe load finish' You clearly HAVE no technical knowledge of as to what a 'RUNPE' actually does. You can inject a file into a remote process whether or not it has been loaded. Despite this you'd have to rebuild the IAT.

You clearly don't know anything about the PE Format, nor the WINDOWS OS.

Also it's InformationProcess NOT ProcessInformation. You got the entire name wrong.

"CONTEXT_AMD64 it's a really baddy converting." What's there to convert? Are you incapable of implementing multiple structures and placing a check for the reference size?

[intrinsic]

Where exactly does it state you can use it to load a .NET file into a remote app domain: http://msdn.microsoft.com/en-us/library/....110).aspx
? I've never played with that function, so well I'm just purely looking on MSDN here.

If you think RunPE's shit then go somewhere else and complain about them, this was thread to learn others how to make 64bit -> 32bit and opposit, possible in .NET with the well known RunPE method as around 99% of all .NET crypters uses it.

Go back to school and learn to manner you language, you über bad mannered guy.

THATS THE POINT OF A CODE CAVE
YOU DELUSIONAL FUCKING RETARD

[whitemask]

thank that is really greate :) :) ✌

[Disasm]

This injection method is terrible and should never be used. The fact that you think this is a cross reference between x64 and x86 baffles me.

Considering .NET is executed by the CLR you can change the base architecture in the headers. This is not a true 'x86->x64' injection. When will .NET programmers start learning native programming for shit like this? Stop misusing the language for it's main purpose.