[gigajew]

I'm sure most of you who are up to speed on .NET development at Hack Forums has heard about the internal method nLoadImage() to load a .NET assembly. The method can cause some problems if you don't know that the signature changes in the different frameworks. I wrote this class to work around that, and you can use it in any framework version to load your assemblies. The purpose of this is to avoid hooks on calls to Assembly.Load

Usage:

NetLoader.Load(byte[]);

[Aristocles]

Thank you

why do you need to cast it as (Assembly) line 16 ? what is the returntype of invoke ?

[D3RP]

Thank you

why do you need to cast it as (Assembly) line 16 ? what is the returntype of invoke ?

https://msdn.microsoft.com/en-us/library....110).aspx

Type object

[gigajew]

Thank you

why do you need to cast it as (Assembly) line 16 ? what is the returntype of invoke ?

It's object to match all methods

[Ninja]

Nice. I wrote something similar for a project of mine, as I wanted to protect a library I made. I had a 'client DLL' and a 'server DLL'. The client DLL contained interfaces and an InstanceBuilder class, and the server DLL contained a reference to client DLL (for the interfaces) and classes that inherited from those interfaces. The InstanceBuilder would accept the server DLL in byte form or stream form or whatever and then you could instantiate the classes that were loaded in. This is still easily breakable but at least offers some protection.

[Paskowsky]

The method.Invoke will be detected, but it's a nice idea 🤝

[gigajew]

The method.Invoke will be detected, but it's a nice idea 🤝

I'm fairly positive (MethodInfo).Invoke is not detected, or (delegate).Invoke would be too, which wouldn't make any sense. Anyway, it's not for the purpose of being undetected by virus analysis, it's just supposed to bypass hooks on Assembly.Load