Comments (10)
Once ICorRuntimeHost::Stop is invoked, the .NET app exits prematurely. Are there any ETW events triggered when a .NET app terminates?
from donut.
I wonder if we could listen for ThreadCreated events for the new ApplicationDomain, then wait until all created threads generate a ThreadTerminated event? https://docs.microsoft.com/en-us/dotnet/framework/performance/application-domain-resource-monitoring-arm-etw-events
from donut.
Hmm... may also be able to use the Unmanaged Profiler API. Can set callbacks for different events.
A promising one is the Shutdown callback which is called when a managed application shuts down. But... the description indicates that it may not work if we have been injected into an originally unmanaged application. https://docs.microsoft.com/en-us/dotnet/framework/unmanaged-api/profiling/icorprofilercallback-shutdown-method
Could also monitor for thread creation and destruction events like with ETW: https://docs.microsoft.com/en-us/dotnet/framework/unmanaged-api/profiling/icorprofilercallback-threadcreated-method
As a last resort, could continuously enumerate threads until we find that all of the correct ones have terminated: https://docs.microsoft.com/en-us/dotnet/framework/unmanaged-api/profiling/icorprofilerinfo4-enumthreads-method
from donut.
Could also use try the Unmanaged CLR Debugging API. ICorDebugProcess lets you get the threads as ICorDebugThread. The thread class lets you check the AppDomain of the thread. So... you could poll the process for threads that are in the AppDomain that we created until none exist. https://docs.microsoft.com/en-us/dotnet/framework/unmanaged-api/debugging/icordebugthread-getappdomain-method
from donut.
Anyway, just researching for now. Looks like it is probably possible, just might be a little painful due to having to poll a process. Unless we can get ETW to work. That would probably be the simplest.
from donut.
The profiling interfaces look very promising. Haven't tested anything using these yet. Plenty of options available, which is good.
from donut.
I just had an idea. What if we queue APC on our current thread (within the loader) that will unload the application domain when it executes? I think the APC should fire either when ExitThread or ExitProcess is called during the loader's termination. Does that sound like it would work?
from donut.
Or we could just stop the CLR and clear the App Domain before calling ExitThread/ExitProcess?
from donut.
Possibly we could RESTART the CLR if need be. The AppDomains should still exist.
from donut.
I forgot to mention doing a test some days ago with the dotnet loader which was able to unload the disposable domain, but not the default domain.
from donut.
Related Issues (20)
- Support for executables without relocation data HOT 2
- How does work on 32bit
- Huffman in version 1.0
- A generator written in pure Go, supporting Donut v1.0
- Add support for resources HOT 1
- TLS handling referencing the wrong headers
- shellcode gen with error?
- capturing stdout of a donut HOT 1
- Running donut only brings up help menu HOT 4
- Suggestion on encoding the loader HOT 1
- [Feature] - ARM64 support HOT 2
- Rsp adjustment breaks shellcode return HOT 1
- Files with SEH support HOT 2
- Shellcode terminates main thread HOT 1
- Module overloading does not work
- Does donut supports injecting into processes with Dynamic Code Prohibited enabled
- No execution with Akagi64 (UACME) HOT 1
- New Detections on AMSI Patch and Headers
- Problem executing Golang binaries HOT 2
- Anti Dump for .Net assemblies
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from donut.