First Update

* Remove useless references * Added loading with only delegates for both kernel32 and ntdll functions
arsium · Jul 14, 2021 · c3ecf26 · c3ecf26
1 parent ca0ef9a
commit c3ecf26
Show file tree

Hide file tree

Showing 41 changed files with 238 additions and 61 deletions.
diff --git a/.vs/ShellCodeLoader/v16/.suo b/.vs/ShellCodeLoader/v16/.suo
diff --git a/.vs/ShellCodeLoader/v16/Browse.VC.db b/.vs/ShellCodeLoader/v16/Browse.VC.db
diff --git a/.vs/ShellCodeLoader/v16/Browse.VC.db-shm b/.vs/ShellCodeLoader/v16/Browse.VC.db-shm
diff --git a/.vs/ShellCodeLoader/v16/Solution.VC.db b/.vs/ShellCodeLoader/v16/Solution.VC.db
diff --git a/.vs/ShellCodeLoader/v16/Solution.VC.db-shm b/.vs/ShellCodeLoader/v16/Solution.VC.db-shm
diff --git a/.vs/ShellCodeLoader/v16/Solution.VC.db-wal b/.vs/ShellCodeLoader/v16/Solution.VC.db-wal
diff --git a/PayloadCSharp/obj/Release/PayloadCSharp.csproj.AssemblyReference.cache b/PayloadCSharp/obj/Release/PayloadCSharp.csproj.AssemblyReference.cache
diff --git a/PayloadCSharp/obj/x64/Release/PayloadCSharp.csproj.AssemblyReference.cache b/PayloadCSharp/obj/x64/Release/PayloadCSharp.csproj.AssemblyReference.cache
diff --git a/PayloadCSharp/obj/x64/Release/PayloadCSharp.csproj.FileListAbsolute.txt b/PayloadCSharp/obj/x64/Release/PayloadCSharp.csproj.FileListAbsolute.txt
@@ -4,3 +4,4 @@ F:\Personal\ShellCodeLoader\PayloadCSharp\bin\x64\Release\PayloadCSharp.pdb
 F:\Personal\ShellCodeLoader\PayloadCSharp\obj\x64\Release\PayloadCSharp.csproj.CoreCompileInputs.cache
 F:\Personal\ShellCodeLoader\PayloadCSharp\obj\x64\Release\PayloadCSharp.exe
 F:\Personal\ShellCodeLoader\PayloadCSharp\obj\x64\Release\PayloadCSharp.pdb
+F:\Personal\ShellCodeLoader\PayloadCSharp\obj\x64\Release\PayloadCSharp.csproj.AssemblyReference.cache
diff --git a/ShellCodeLoader.sln b/ShellCodeLoader.sln
@@ -35,8 +35,8 @@ Global
 		{B2A57A97-4D88-4942-A4B3-06AA466080F2}.Release|x86.Build.0 = Release|Any CPU
 		{9B489FF7-A0FB-4813-96AD-B6D604DA87FC}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{9B489FF7-A0FB-4813-96AD-B6D604DA87FC}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{9B489FF7-A0FB-4813-96AD-B6D604DA87FC}.Debug|x64.ActiveCfg = Debug|Any CPU
-		{9B489FF7-A0FB-4813-96AD-B6D604DA87FC}.Debug|x64.Build.0 = Debug|Any CPU
+		{9B489FF7-A0FB-4813-96AD-B6D604DA87FC}.Debug|x64.ActiveCfg = Debug|x64
+		{9B489FF7-A0FB-4813-96AD-B6D604DA87FC}.Debug|x64.Build.0 = Debug|x64
 		{9B489FF7-A0FB-4813-96AD-B6D604DA87FC}.Debug|x86.ActiveCfg = Debug|Any CPU
 		{9B489FF7-A0FB-4813-96AD-B6D604DA87FC}.Debug|x86.Build.0 = Debug|Any CPU
 		{9B489FF7-A0FB-4813-96AD-B6D604DA87FC}.Release|Any CPU.ActiveCfg = Debug|Any CPU

diff --git a/ShellCodeLoader/ShellCodeLoader.cs b/ShellCodeLoader/ShellCodeLoader.cs
diff --git a/ShellCodeLoader/ShellCodeLoader.csproj b/ShellCodeLoader/ShellCodeLoader.csproj
@@ -32,13 +32,7 @@
   </PropertyGroup>
   <ItemGroup>
     <Reference Include="System" />
-    <Reference Include="System.Core" />
-    <Reference Include="System.Xml.Linq" />
-    <Reference Include="System.Data.DataSetExtensions" />
     <Reference Include="Microsoft.CSharp" />
-    <Reference Include="System.Data" />
-    <Reference Include="System.Net.Http" />
-    <Reference Include="System.Xml" />
   </ItemGroup>
   <ItemGroup>
     <Compile Include="ShellCodeLoader.cs" />

diff --git a/ShellCodeLoader/obj/Debug/ShellCodeLoader.csproj.AssemblyReference.cache b/ShellCodeLoader/obj/Debug/ShellCodeLoader.csproj.AssemblyReference.cache
diff --git a/ShellCodeLoader/obj/Debug/ShellCodeLoader.csproj.CoreCompileInputs.cache b/ShellCodeLoader/obj/Debug/ShellCodeLoader.csproj.CoreCompileInputs.cache
@@ -1 +1 @@
-a8992992a2a1f857e94d2c190e6e2acb3d35d990
+2f4efe2492a647ca473cd41a9e195057146d9428
diff --git a/ShellCodeLoader/obj/Debug/ShellCodeLoader.dll b/ShellCodeLoader/obj/Debug/ShellCodeLoader.dll
diff --git a/ShellCodeLoader/obj/Debug/ShellCodeLoader.pdb b/ShellCodeLoader/obj/Debug/ShellCodeLoader.pdb
diff --git a/ShellCodeLoader/obj/Release/DesignTimeResolveAssemblyReferencesInput.cache b/ShellCodeLoader/obj/Release/DesignTimeResolveAssemblyReferencesInput.cache
diff --git a/ShellCodeLoader/obj/Release/ShellCodeLoader.csproj.CoreCompileInputs.cache b/ShellCodeLoader/obj/Release/ShellCodeLoader.csproj.CoreCompileInputs.cache
@@ -1 +1 @@
-9fef0c49f4b5f7b005b68c57fc326668b2cc8ace
+1c02f89cdd426da38f937db1d7ded7d8cbdc2708
diff --git a/ShellCodeLoader/obj/Release/ShellCodeLoader.dll b/ShellCodeLoader/obj/Release/ShellCodeLoader.dll
diff --git a/ShellCodeLoader/obj/Release/ShellCodeLoader.pdb b/ShellCodeLoader/obj/Release/ShellCodeLoader.pdb
diff --git a/Test/Form1.Designer.cs b/Test/Form1.Designer.cs
diff --git a/Test/Form1.cs b/Test/Form1.cs
@@ -61,5 +61,52 @@ private void button2_Click(object sender, EventArgs e)
                 csharp.Dispose();
             }
         }
+
+        private void button3_Click(object sender, EventArgs e)
+        {
+            if (IntPtr.Size == 8)
+            {
+                ShellCodeLoader.ShellCodeLoader cpp = new ShellCodeLoader.ShellCodeLoader(PayloadCpp64.rawData);
+                cpp.LoadWithNTDelegates();
+                cpp.Dispose();
+                ShellCodeLoader.ShellCodeLoader csharp = new ShellCodeLoader.ShellCodeLoader(PayloadCSharp64.rawData);
+                csharp.LoadWithNTDelegates();
+                csharp.Dispose();
+            }
+            else
+            {
+                ShellCodeLoader.ShellCodeLoader cpp = new ShellCodeLoader.ShellCodeLoader(PayloadCpp32.rawData);
+                cpp.Asynchronous = true;
+                cpp.LoadWithNTDelegates();
+                cpp.Dispose();
+                ShellCodeLoader.ShellCodeLoader csharp = new ShellCodeLoader.ShellCodeLoader(PayloadCSharp32.rawData);
+                csharp.LoadWithNTDelegates();
+                csharp.Dispose();
+            }
+        }
+
+        private void button4_Click(object sender, EventArgs e)
+        {
+            if (IntPtr.Size == 8)
+            {
+                ShellCodeLoader.ShellCodeLoader cpp = new ShellCodeLoader.ShellCodeLoader(PayloadCpp64.rawData);
+                cpp.LoadWithKernel32Delegates();
+                cpp.Dispose();
+                ShellCodeLoader.ShellCodeLoader csharp = new ShellCodeLoader.ShellCodeLoader(PayloadCSharp64.rawData);
+                csharp.LoadWithKernel32Delegates();
+                csharp.Dispose();
+            }
+            else
+            {
+                ShellCodeLoader.ShellCodeLoader cpp = new ShellCodeLoader.ShellCodeLoader(PayloadCpp32.rawData);
+                cpp.Asynchronous = true;
+                cpp.LoadWithKernel32Delegates();
+                cpp.Dispose();
+                ShellCodeLoader.ShellCodeLoader csharp = new ShellCodeLoader.ShellCodeLoader(PayloadCSharp32.rawData);
+                csharp.LoadWithKernel32Delegates();
+                csharp.Dispose();
+            }
+
+        }
     }
 }
diff --git a/Test/obj/Debug/DesignTimeResolveAssemblyReferences.cache b/Test/obj/Debug/DesignTimeResolveAssemblyReferences.cache
diff --git a/Test/obj/Debug/Test.csproj.AssemblyReference.cache b/Test/obj/Debug/Test.csproj.AssemblyReference.cache
diff --git a/Test/obj/Debug/Test.csproj.GenerateResource.cache b/Test/obj/Debug/Test.csproj.GenerateResource.cache
diff --git a/Test/obj/Debug/Test.exe b/Test/obj/Debug/Test.exe
diff --git a/Test/obj/Debug/Test.pdb b/Test/obj/Debug/Test.pdb
diff --git a/Test/obj/Release/Test.Form1.resources b/Test/obj/Release/Test.Form1.resources
diff --git a/Test/obj/Release/Test.Properties.Resources.resources b/Test/obj/Release/Test.Properties.Resources.resources
diff --git a/Test/obj/Release/Test.csproj.AssemblyReference.cache b/Test/obj/Release/Test.csproj.AssemblyReference.cache
diff --git a/Test/obj/Release/Test.csproj.CopyComplete b/Test/obj/Release/Test.csproj.CopyComplete
diff --git a/Test/obj/Release/Test.csproj.CoreCompileInputs.cache b/Test/obj/Release/Test.csproj.CoreCompileInputs.cache
@@ -0,0 +1 @@
+cc3bca52f731fc5b76c24ac730a2561f6c360edc
diff --git a/Test/obj/Release/Test.csproj.FileListAbsolute.txt b/Test/obj/Release/Test.csproj.FileListAbsolute.txt
@@ -0,0 +1,13 @@
+F:\Personal\ShellCodeLoader\Test\bin\Release\Test.exe.config
+F:\Personal\ShellCodeLoader\Test\bin\Release\Test.exe
+F:\Personal\ShellCodeLoader\Test\bin\Release\Test.pdb
+F:\Personal\ShellCodeLoader\Test\bin\Release\ShellCodeLoader.dll
+F:\Personal\ShellCodeLoader\Test\bin\Release\ShellCodeLoader.pdb
+F:\Personal\ShellCodeLoader\Test\obj\Release\Test.csproj.AssemblyReference.cache
+F:\Personal\ShellCodeLoader\Test\obj\Release\Test.Form1.resources
+F:\Personal\ShellCodeLoader\Test\obj\Release\Test.Properties.Resources.resources
+F:\Personal\ShellCodeLoader\Test\obj\Release\Test.csproj.GenerateResource.cache
+F:\Personal\ShellCodeLoader\Test\obj\Release\Test.csproj.CoreCompileInputs.cache
+F:\Personal\ShellCodeLoader\Test\obj\Release\Test.csproj.CopyComplete
+F:\Personal\ShellCodeLoader\Test\obj\Release\Test.exe
+F:\Personal\ShellCodeLoader\Test\obj\Release\Test.pdb
diff --git a/Test/obj/Release/Test.csproj.GenerateResource.cache b/Test/obj/Release/Test.csproj.GenerateResource.cache
diff --git a/Test/obj/Release/Test.exe b/Test/obj/Release/Test.exe
diff --git a/Test/obj/Release/Test.pdb b/Test/obj/Release/Test.pdb
diff --git a/Test/obj/x64/Debug/Test.csproj.AssemblyReference.cache b/Test/obj/x64/Debug/Test.csproj.AssemblyReference.cache
diff --git a/Test/obj/x64/Debug/Test.csproj.CoreCompileInputs.cache b/Test/obj/x64/Debug/Test.csproj.CoreCompileInputs.cache
@@ -1 +1 @@
-e611841c91334bbfdd54b06c6f65ffef0d5bc2a6
+69ed1963c678b7433cfcad1463c463db4cb3db12
diff --git a/Test/obj/x64/Debug/Test.csproj.GenerateResource.cache b/Test/obj/x64/Debug/Test.csproj.GenerateResource.cache
diff --git a/Test/obj/x64/Debug/Test.exe b/Test/obj/x64/Debug/Test.exe
diff --git a/Test/obj/x64/Debug/Test.pdb b/Test/obj/x64/Debug/Test.pdb
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		a8992992a2a1f857e94d2c190e6e2acb3d35d990
		2f4efe2492a647ca473cd41a9e195057146d9428
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		9fef0c49f4b5f7b005b68c57fc326668b2cc8ace
		1c02f89cdd426da38f937db1d7ded7d8cbdc2708
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		e611841c91334bbfdd54b06c6f65ffef0d5bc2a6
		69ed1963c678b7433cfcad1463c463db4cb3db12