I've developped a small decrypt and execute application and I'm stuck at the execution part. I succesfully execute .NET assemblies using the method below:
Assembly asm = Assembly.Load(decryptedBytes);
if (asm.EntryPoint == null)
throw new ApplicationException("No entry point found!");
MethodInfo ePoint = asm.EntryPoint;
object ins = asm.CreateInstance(ePoint.Name);
ePoint.Invoke(ins, null);
But when I try allocating an executable region using this post the application crashes
The only useful information I get is this:
Fault Module Name: StackHash_0a9e
Here is my code:
const uint PAGE_EXECUTE_READWRITE = 0x40;
const uint MEM_COMMIT = 0x1000;
[DllImport("kernel32.dll", SetLastError = true)]
static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
private delegate int IntReturner();
IntPtr buf = VirtualAlloc(IntPtr.Zero, (uint)decryptedBytes.Length, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
Marshal.Copy(decryptedBytes, 0, buf, decryptedBytes.Length);
IntReturner ptr = (IntReturner)Marshal.GetDelegateForFunctionPointer(buf, typeof(IntReturner));
Console.WriteLine(ptr());