dotNetPELoader

Recently, when I was developing a fileless execution method for DuplexSpy RAT, I could hardly find a C#-based x86 PE loader.

Most existing implementations I found were x64-only, such as the one developed by Casey Smith. Therefore I decided to develop a x86 version C# based PE loader myself.

This console application allows you to load x86 or x64 PE file into memory.
First, it reads the file bytes from the specified file path, then determines the architecture of both the loader and the target PE file.

An x64 PE cannot be loaded by an x86 loader, and vice versa.

Usage

dotNetLoader.exe --x64 x64_file.exe
dotNetLoader.exe --x86 x86_file.exe
dotNetLoader.exe --coffee

Demonstration

x64 - Loading an x64 mimikatz:

If you try to load an x86 PE while the loader is an x64 loader, an exception will be thrown:

> dotNetPELoader.exe --x64 minikatz.exe

> dotNetPELoader.exe --x64 minikatz.exe

x86 - Loading an x86 mimikatz:

> dotNetPELoader.exe --x86 minikatz.exe