Comments (5)
Mixed (native and managed) assemblies need to be executed in the PE loader rather than the CLR loader which is why AppDomain::Load_3() fails to the load the assembly. I tried to get the PE loader to run a mixed assembly by manually calling mscoree!_CorDllMain() which does execute indicating successful initialization of the .NET methods. An unmanaged export executes as expected with the correct address, but unfortunately the CLR crashes with an exception and I'm not sure why yet. Until a solution is found, I've added a check to the generator that returns an error "Mixed (native and managed) assemblies are currently unsupported."
from donut.
After a closer look at why the CLR crashes, initialization routines in _CorDllMain expect the mixed assembly to be loaded into the current process via LoadLibrary(). Donut maps the DLL manually, and is therefore not present in the PEB. To obtain runtime information from the PE header, GetModuleFileName() is called and because it receives a pointer to where the DLL is manually mapped, it returns an error: "The specified module could not be found." As a result of this, the methods inside the mixed assembly are not properly initialized and when called crash the CLR. As for how to solve all this, I'm open to suggestions.
from donut.
Labeled this as wontfix
. Will leave the Issue unclosed in case somebody wants to tackle it.
from donut.
you can add the dll entry in the modules list of peb, that should fix it if its just related to peb resolving
from donut.
@0x410c I examined this problem and most of the functions try to open a file from the disk. For in-memory execution, that means you need to hook any API that opens files. If someone wants to support it, submit a pull request. We won't support it.
from donut.
Related Issues (20)
- Support for executables without relocation data HOT 2
- How does work on 32bit
- Huffman in version 1.0
- A generator written in pure Go, supporting Donut v1.0
- Add support for resources HOT 1
- TLS handling referencing the wrong headers
- shellcode gen with error?
- capturing stdout of a donut HOT 1
- Running donut only brings up help menu HOT 4
- Suggestion on encoding the loader HOT 1
- [Feature] - ARM64 support HOT 2
- Rsp adjustment breaks shellcode return HOT 1
- Files with SEH support HOT 2
- Shellcode terminates main thread HOT 1
- Module overloading does not work
- Does donut supports injecting into processes with Dynamic Code Prohibited enabled
- No execution with Akagi64 (UACME) HOT 1
- New Detections on AMSI Patch and Headers
- Problem executing Golang binaries HOT 2
- Anti Dump for .Net assemblies
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from donut.