Removed unused code

examples/C2Framework/C2Framework.go

@@ -14,7 +14,6 @@ import (
 	"io/ioutil"
 	"log"
 	"os"
-	"syscall"
 
 	// 3rd Party
 	clr "github.com/ropnop/go-clr"
@@ -58,22 +57,6 @@ func main() {
 		fmt.Printf("[DEBUG] Returned ICORRuntimeHost: %+v\n", runtimeHost)
 	}
 
-	// Create a new AppDomain
-	if *verbose {
-		fmt.Println("[-] Creating a new AppDomain...")
-	}
-	domain, err := syscall.UTF16PtrFromString("rubeus")
-	if err != nil {
-		log.Fatal(err)
-	}
-	appDomain, err := runtimeHost.CreateDomain(domain)
-	if err != nil {
-		log.Fatal(err)
-	}
-	if *debug {
-		fmt.Printf("[DEBUG] Returned AppDomain: %v\n", appDomain)
-	}
-
 	// Get Rubeus
 	rubeusBytes, err := ioutil.ReadFile(rubeusPath)
 	if err != nil {

go-clr.go

@@ -297,20 +297,6 @@ func ExecuteByteArrayDefaultDomain(runtimeHost *ICORRuntimeHost, rawBytes []byte
 	return
 }
 
-func LoadByteArrayInAppDomain(appDomain *AppDomain, rawBytes []byte) (methodInfo *MethodInfo, err error) {
-	safeArrayPtr, err := CreateSafeArray(rawBytes)
-	if err != nil {
-		return
-	}
-
-	assembly, err := appDomain.Load_3(safeArrayPtr)
-	if err != nil {
-		return
-	}
-
-	return assembly.GetEntryPoint()
-}
-
 // LoadAssembly uses a previously instantiated runtimehost and loads an assembly into the default AppDomain
 // and returns the assembly's methodInfo structure. The intended purpose is for the assembly to be loaded
 // once but executed many times throught the duration of the program. Commonly used with C2 frameworks

icorruntimehost.go

@@ -17,6 +17,7 @@ type ICORRuntimeHost struct {
 // ICORRuntimeHostVtbl Provides methods that enable the host to start and stop the common language runtime (CLR)
 // explicitly, to create and configure application domains, to access the default domain, and to enumerate all
 // domains running in the process.
+// https://docs.microsoft.com/en-us/dotnet/framework/unmanaged-api/hosting/icorruntimehost-interface
 type ICORRuntimeHostVtbl struct {
 	QueryInterface uintptr
 	AddRef         uintptr
@@ -195,7 +196,34 @@ func (obj *ICORRuntimeHost) CreateDomain(pwzFriendlyName *uint16) (pAppDomain *A
 		debugPrint(fmt.Sprintf("the ICORRuntimeHost::CreateDomain method returned an error:\r\n%s", err))
 	}
 	if hr != S_OK {
-		err = fmt.Errorf("the ICORRuntimeHost::CreateDomain method method returned a non-zero HRESULT: 0x%x", hr)
+		err = fmt.Errorf("the ICORRuntimeHost::CreateDomain method returned a non-zero HRESULT: 0x%x", hr)
+		return
+	}
+	err = nil
+	return
+}
+
+// EnumDomains Gets an enumerator for the domains in the current process.
+// HRESULT EnumDomains (
+//   [out] HCORENUM *hEnum
+// );
+func (obj *ICORRuntimeHost) EnumDomains() (hEnum *uintptr, err error) {
+	debugPrint("Enterin into icorruntimehost.EnumDomains()...")
+
+	hr, _, err := syscall.Syscall(
+		obj.vtbl.EnumDomains,
+		(uintptr(unsafe.Pointer(hEnum))),
+		0,
+		0,
+		0,
+	)
+
+	if err != syscall.Errno(0) {
+		err = fmt.Errorf("the ICORRuntimeHost::EnumDomains method returned an error:\n%s", err)
+		return
+	}
+	if hr != S_OK {
+		err = fmt.Errorf("the ICORRuntimeHost::EnumDomains method returned a non-zero HRESULT: 0x%x", hr)
 		return
 	}
 	err = nil