/InMemoryNET

Exploring in-memory execution of .NET

Primary LanguageC++MIT LicenseMIT

InMemoryNET

This project is entirely a POC, it was my research into looking at how execute-assembly works within Cobalt Strike. The project contains two solutions:

  1. ConsoleApp1: An example C# Project that will be executed via the unmanaged code
  2. InMemoryNET: The unmanaged code to execute .NET

As well as executing the .NET Assembly, it will patching AMSI and ETW and is intended to be purely a reference piece.

Referenced projects:

  1. HostingCLR
  2. metasploit-execute-assembly
  3. Hiding your .NET - ETW