RunPE .net

zrty · 2017-06-15T10:52:15+00:00

Hey, I'm currently working on my crypter and since I was experiencing trouble with executing .net assembly I wrote this function. I've also added a code to determine if the PE file is a .net program. struct sDotNet { ~sDotNet() { if (pMetaHost) pMetaHost->Release(); if (pRuntimeInfo) pRuntimeInfo->Release(); if (pCorRuntimeHost) pCorRuntimeHost->Release(); } ICLRMetaHost *pMetaHost = nullptr; ICLRRuntimeInfo *pRuntimeInfo = nullptr; ICorRuntimeHost *pCorRuntimeHost = nullptr; }; struct sSafeArray { sSafeArray() { } sSafeArray(SAFEARRAY *Array) : pArray(Array) { } ~sSafeArray() { if (pArray) SafeArrayDestroy(pArray); } SAFEARRAY *pArray = nullptr; }; bool isDotNet(PIMAGE_NT_HEADERS pNT) { if (pNT->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC) { if ((reinterpret_castOptionalHeader.DataDirectory.VirtualAddress) return true; } else { if ((reinterpret_cast(pNT))->OptionalHeader.DataDirectory.VirtualAddress) return true; } return false; } bool runDotNet(BYTE *pBuffer, DWORD dwSize)

Tester
Guest

Jun 16, 2017 09:00 AM

This is my test. Please check it.

Next Oldest | Next Newest

New Reply

Possibly Related Threads...
Thread / Author	Replies	Views	Last Post
[.NET] C++ RunPE & .NET support by snowman13Mar 12, 2021 03:28 AM	7	1,116	Mar 12, 2021 03:28 AM Last Post: Joseph Ducreux
[.NET] ProjectorPE \| Stable RunPE substitute for .NET assemblies! C# AND VB.NET! by gigajewNov 3, 2020 08:41 PM	20	4,138	Nov 3, 2020 08:41 PM Last Post: Menalix
[C#] ManagedRunPE \| RunPE substitute for .NET assemblies by gigajewMar 13, 2018 10:44 AM	7	1,237	Mar 13, 2018 10:44 AM Last Post: subtilebestia

View a Printable Version
Export as PDF
Subscribe to this thread

Login
Username/Email:
Password:	Lost Password?
	Remember me