Show/Hide TOC

UtilDebugShellCodeExecute Method

Executes a specified ShellCode byte array by copying it to pinned memory, modifying the memory permissions with VirtualProtect function, and executing using a Action delegate.

Note that you can generate a hex string / byte array of ASM code at: https://defuse.ca/online-x86-assembler.htm

Definition

Namespace: DevCase.Core.Diagnostics.Debugging.Common
Assembly: DevCase.net48 (in DevCase.net48.dll) Version: 6.0.0.0 (6.0)
XMLNS for XAML: Not mapped to an xmlns.

C#Request Example

public static bool ShellCodeExecute(
	byte[] shellCode,
	bool throwOnError
)

VBRequest Example

Public Shared Function ShellCodeExecute ( 
	shellCode As Byte(),
	throwOnError As Boolean
) As Boolean

Dim shellCode As Byte()
Dim throwOnError As Boolean

Dim returnValue As Boolean

returnValue = UtilDebug.ShellCodeExecute(shellCode, 
	throwOnError)

C++Request Example

public:
static bool ShellCodeExecute(
	array<unsigned char>^ shellCode, 
	bool throwOnError
)

F#Request Example

static member ShellCodeExecute : 
        shellCode : byte[] * 
        throwOnError : bool -> bool

ASP.NETRequest Example

No code example is currently available or this language may not be supported.

Parameters

shellCode Byte: [Missing <param name="shellCode"/> documentation for "M:DevCase.Core.Diagnostics.Debugging.Common.UtilDebug.ShellCodeExecute(System.Byte[],System.Boolean)"]
throwOnError Boolean: If and a error occurs during execution, an exception will be thrown.

Return Value

Boolean
if execution succeeds, otherwise.

Remarks

Based upon code written by Matt Nelson (@enigma0x3) and Matt Graeber (@mattifestation).

Example

This is a code example.

C#

No code example is currently available or this language may not be supported.

VB

Dim shellCode() As Byte = { ' x86 assembly instructions for 'BrokenByte msgbox test':
    &H31, &HD2, &HB2, &H30, &H64, &H8B, &H12, &H8B,
    &H52, &HC, &H8B, &H52, &H1C, &H8B, &H42, &H8,
    &H8B, &H72, &H20, &H8B, &H12, &H80, &H7E, &HC,
    &H33, &H75, &HF2, &H89, &HC7, &H3, &H78, &H3C,
    &H8B, &H57, &H78, &H1, &HC2, &H8B, &H7A, &H20,
    &H1, &HC7, &H31, &HED, &H8B, &H34, &HAF, &H1,
    &HC6, &H45, &H81, &H3E, &H46, &H61, &H74, &H61,
    &H75, &HF2, &H81, &H7E, &H8, &H45, &H78, &H69,
    &H74, &H75, &HE9, &H8B, &H7A, &H24, &H1, &HC7,
    &H66, &H8B, &H2C, &H6F, &H8B, &H7A, &H1C, &H1,
    &HC7, &H8B, &H7C, &HAF, &HFC, &H1, &HC7, &H68,
    &H79, &H74, &H65, &H1, &H68, &H6B, &H65, &H6E,
    &H42, &H68, &H20, &H42, &H72, &H6F, &H89, &HE1,
    &HFE, &H49, &HB, &H31, &HC0, &H51, &H50, &HFF, &HD7
} ' Note that you can disassemble this shellcode at: https://defuse.ca/online-x86-assembler.htm#disassembly

Dim success As Boolean = ShellCodeExecute(shellCode, throwOnError:=True)
Console.WriteLine(success)

C++

No code example is currently available or this language may not be supported.

F#

No code example is currently available or this language may not be supported.

XAML

No code example is currently available or this language may not be supported.

ASP.NET

No code example is currently available or this language may not be supported.