From e646802bbd573ce5ec93e4119ed5ba1a32756181 Mon Sep 17 00:00:00 2001 From: loland <73586395+loland@users.noreply.github.com> Date: Wed, 10 Dec 2025 22:54:24 +0800 Subject: [PATCH] -scan flag fixes LoadLibraryA("clr.dll") does not work. Load clr.dll via startCLR() instead --- inlineExecute/inlineExecute.o | Bin 25022 -> 25218 bytes src/inlineExecute.c | 14 ++++++++++++-- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/inlineExecute/inlineExecute.o b/inlineExecute/inlineExecute.o index 1b3a84f056a2b75f57c09df726515b4826653c51..892a65231a503c89d93a06e797786b28e0c0d438 100644 GIT binary patch delta 4059 zcmZXW3v82B6vt0X*#>M-9u5$+Wh*e4V*5S%P#B%StjQwF0GUyfEkHozu|x=JFdt9B zzz9oq83xEOBrIqmp{OVbQ3Rk(-K2N4z<;Y+jjg=KmHv zU)3u=8j>>3PxM}(^1Ccstnzkt=i}Xo_D1{LhT1C&V$a&rduB!|9x+F#NB-s4wUMO< zg9jR86ML=dVJyB@jZmZ_!^|+}q{w??J?_ZTg&sHcSiZy*QZOffXAoLF9;qnwl!!Uw zZ^Q%@6Fnu7RfV3M_*=eeg1`mB@kyh@vX%|>@@4DCddz8QoLU#b3_){tZ%g!iR=>vz zS0VPlRV+SemVO}CDLc*fOj~CZx^%av#++h)=gTeTd#P}5N8zhIPV`mO9`ky>?_wP2 zLG(4oI_M~f3&@X4A2pd_6C_>BL}%a-!Kgar8AX-Mln@@ zjxv1!64y9p07tTP4j^h|>IV|x@t{0*Ye3&JRasH{K%&v?@<87)6@bLpbD%K0qQ{87 zXPN{O3n>FN!5I#E9VpuMHs}~9F0)(%=s3HxpdXknS<(KF6XDat+6RM9Fg*nl^UVaE zWH--p6`)h>(p^M98jO8_qG}y<>A4?v=r?rx%=*=2%+bA!gR8w?6C`9Z%h<$*-r7!VF9 zlrRz0%=8LKL>GbbO=r+*;IAgq`ydgn0sY3V)^b-s-P!#E!XCs3=O7~NRnTydaAC`p zSX6G&N{coy8RpCjuX zEdd2NuL^XDX=4`lzgY2B$lqCR2MM_1! z5ggqPGDP^W6+R2P&EX3m(abh0+6(*UDUJ>T{mGOI!XFBpftNc>c)s#Gb~Ej4HEUA1cf+!4fGdND@aV(6C3*(cDbOtOe#o3=YYnrTMoL%RAEKegWA|_ zj=Ky8eFFTO<&Nln?YERvJEhusN4M&gwoB2G{w>`n*$|CCY^kx^{)?#tUe0~hJ*KeO zJ!RIkvN`k1-BaeyE}u1R-n6bnv8Fs%YR-k?`}ZH#SJm4#+^5C)-r)~jw?{tt<+>|n z+Ks$-Jr{m`e%JNTbocnoXy1a}>E@3g^9PT5bMo2PF9l!Ojb?1?PUObZd`!Sgky98u zn^KsXBr_Yvizb+(M9u;jCr;-MQw_5=$?Sls!|v|LX@t3DWG1TfQ0~5o<~mF`$=Dr4 zbTL&9MS6b z9P_pNwg@@gn9LG!zGFi#f@UlEjpB#BUYa{ zk63-;D6F13Mf()G93Q*xt%(K-6~|rW-lo{>!Zb&^`6JtW)E6&36I)z#!)~adTC_D4 zt`m7CJQwi$bYFvPl+(#ZQ9><}QN3-l@i{vu&8!4`ZrK=$S5|5y*{Hr?iDZ<(49WPF zm9kN*Wuw)~CJ@*userFVHhRC5q;;r)P*HUA#B8HB*=w42r)+#pvQe64qqfOLbK(O@ z_)IiSUxrU8$@txdoD>L3#;=sfMw=lUeWh&t)v^iJ$R^Z~T98~(z}qY(1$=2~QjQXo zjT-ItqQ|I7*1Do@lZ|#-Hac}lnqF6eIkE|rNJjN8l8w5}kd<~?Hag+nfCaYi6J7O( zWfLfsO>mK9G_6K9dQ(@Nmx)tr!E2c79Hr}F*#ygF6RMGn-`miQVjoWS Gbo~$9Y9=rM delta 3867 zcmZ9OX>b!|7{{NKP|AHMSgP321}Fk$v&n8!L>oCXPDKy|5zuzp(IP60!oUY{E9HSQOc@~I=Jp{9uv-KAim4Jbh-ni@XW9y?W2%wS zTF@SL`$3|=wf7OBvK9uey`Si74(|bp4jVu^yR)FZOpP+y1p0>EpCHlUt0<?NAAqdhj6VYpFkJ+RDYSyb6#fAn6U^{vAYL4&E!sRoAe;i_ZG_$QqBOKVK*Bj=Dz^+1G`1iy#xA@T^UGB zVLj+9yKSJKm_7%I8r6f&u{$o^*>sC&9Lq+?Ak%Ho&rEk^;=dr1T~80ud8P+IqU%RN zPq3Q^YGisEB%-rGzpyKmZVRY~?JW8dh`S7BZ2;jO1YMVo2DZ6WNt&dHq&bongT`|& z?}08bZ3Ky0)_|}DVvHjo4fh}L0`MZsD>CsONK_^@qpdQ-K_SiygDx>eKw_QKK$qFg zmTn&CS9Whow;UvDS(SnDM{)Qw$SX{{WMVzY-uK*eT)K;(YwT`FH!!oU{1MO?j^=}| zGZllx1Q&yDu(PDI)&iSYu9LDFbd%i{>AnCpv)dzG1LzjJGtzbO650E>n+AaFr;MAz zphuWq1Zhm~fQE_vuS&}8ARmXDLBpB4;>3w2=^zo!1!Z$|wu~;2(G{Q;j+TSO+N))> z7BrHhhd|bC##2CX6ZOGQE4wt1Xgn138#|wLVG!ns)jb0e6MP9ICTM|jIJyq>J5v=% z^tTiAD7#aWfqyWbli^fcpkvvM1pUbr1c}BIK!35DB;9n-9d<87rx_QL-7a!}P0`V2 zrR#L`sQGb^0WL)2$BpDzY4B2~*s9#LPFYPKZQH-A;XbpX>T=;5i>sH-NNa7{S+#m} zL7@5ZmEMcL+#0cEXY-TV*=YTQ+HUsCgZ;uVy=lhQSmneoldJ~ZuN}yPk9|zVPq>#b zNo?|ADjeoD7!Ourw-Pyv?Z((x+sy`;5{LN|rUs9?_MF2ojaI)zbq=c61BvD)jOH*& zZlZjL=?7EdFvDOxcwV*-mJ8G1Ff(Da{@6X*lU{+Uz>~7wEQP6am~uM@53BZ^jW8_^ z^C66er;f-enm@I$;B}(O*nx$4c|MnxN<7#-g!1N1vLF5N;u9qkjL*I(MXBS)ekq8T zx-G}PNJXjJjJ?5$Qpb(GSH&xoXzU7EsIM5zu#-fI5{<^Ij~kw%s8HPKcHg2xi8*5R ziT#MxC$_@ssY7&sUb?%m_2c~LwLIOOGIQ+7So%{b?r!!=s(p+Km#vEVr!*&7hPD}H z?F83>yi+FzO`qZ0;WWA)I;fhQGm7zREs6Cw^K&w%WuTC}k8P)h(R1;W^ z^O0~)0s+JR>o8`jr6?mOq!`l|QH@@#8vhd27$vGPH>)OC*J*-tMrP=$nv|28;>-zZ zVW%;Cf#|O3UaLaUx^IVS^hVVfDV-hN8@d@%O)y_Eeyu_^z8#jT^hVYAJzboG`2%6q z82O3`_)1ix*Qmy*?SlOhwQIWtjevPjP0DFejG=pQGbgq(jLE7oOH>owEKPP{@w_)p M-uq$;p6k=)e}O9l#Q*>R diff --git a/src/inlineExecute.c b/src/inlineExecute.c index 5e05e03..a569539 100644 --- a/src/inlineExecute.c +++ b/src/inlineExecute.c @@ -440,7 +440,7 @@ static void cleanupCLR(HMODULE kernel32Base, CLRContext* ctx) { ctx->pAssembly = NULL; } - // unloads SacrifcialAppDomain + // unloads Sacrificial AppDomain if (ctx->pCorRuntimeHost && ctx->pSacrifcialAppDomain) { ctx->pCorRuntimeHost->lpVtbl->UnloadDomain(ctx->pCorRuntimeHost, (IUnknown *)(ctx->pSacrifcialAppDomain)); } @@ -474,7 +474,7 @@ static void cleanupCLR(HMODULE kernel32Base, CLRContext* ctx) { _FreeConsole pFreeConsole = (_FreeConsole)getProcAddr(kernel32Base, "FreeConsole"); pFreeConsole(); - // BeaconPrintf(CALLBACK_OUTPUT, "[+] CLR cleanup complete\n"); + BeaconPrintf(CALLBACK_OUTPUT, "[+] CLR cleanup complete\n"); } static void restoreStd(HMODULE kernel32Base, HANDLE hOriginalStdout, HANDLE hWritePipe) { @@ -882,6 +882,15 @@ void doScan() { HMODULE clrBase = getImageBase(L"clr.dll"); if (clrBase == NULL) { HMODULE kernel32Base = getImageBase(L"KERNEL32.DLL"); + + BOOL result; + + // load clr.dll into the current process + CLRContext ctx; + MSVCRT$memset(&ctx, 0, sizeof(ctx)); + startCLR(&ctx, 0); + cleanupCLR(kernel32Base, &ctx); + _LoadLibraryA loadLibraryA = (_LoadLibraryA)getProcAddr(kernel32Base, "LoadLibraryA"); clrBase = loadLibraryA("clr.dll"); @@ -937,6 +946,7 @@ void go(char *args, int len) { // initialize custom context struct to hold CLR values CLRContext ctx; + MSVCRT$memset(&ctx, 0, sizeof(ctx)); result = startCLR(&ctx, verbose); if (!result) { cleanupCLR(kernel32Base, &ctx);