[gigajew]

Here's my managed alternative to a RunPE. Works with x86->AnyCPU/x86 and x64->AnyCPU/x86/x64. It fully supports parameters and GUI applications. It's not going to follow any particular coding conventions so don't even mention it. It runs fine. It checks whether the assembly is actually managed or not before trying to load it. The Inject method returns a Boolean value indicating success or failure.

Usage:

Code

ManagedRunPE.Inject(byte[] buffer, bool emptybuffer, params string[] arguments);

Source code:

[Scapula™]

Good work gigajew and thx for your contribution to the .Net section.

[mundi_86]

great work, thx 4 sharing the code with us.
i will play with it :)

[gigajew]

Added detection for MTAThread/STAThread and implemented RtlZeroMemory(); to delete header in memory, added some null calls and garbagecollector collection

[novak80]

I'm not an expert at RunPE or C# for that matter, but I have a question - does this inject the executable from which it was run into another executable, or the other way around? Or should I word it differently....does this code go into what we want to inject, or another process that is supposed to seem "legit"?

[gigajew]

I'm not an expert at RunPE or C# for that matter, but I have a question - does this inject the executable from which it was run into another executable, or the other way around?  Or should I word it differently....does this code go into what we want to inject, or another process that is supposed to seem "legit"?

It basically just loads the assembly from a byte array and invokes the entrypoint method

[gigajew]

Updated and refactored code, clears memory properly & asynchronously invokes

---

Not compatible with Quasar at the moment

[subtilebestia]

Thanks for your effort. Tested it and looks good.