Chapter 3: Running/Calling Managed Code Directly by Windows Native Api CreateThread + JMP Method

Chapter3: Running/Calling Managed Code Directly by Windows Native Api CreateThread + JMP Method
eBook : Bypassing Anti-Viruses by C# Programming v2.0
Published by Damon Mohammadbagher

Video: Running C# Method by Windows Native Api CreateThread , yeah you can Run Managed Code in-memory by CreateThread API very simple , this Technique is old but only old/experienced C# developers knows this trick/technique. [ i talked about this in my new Ebook Bypassing AVs by C# Programming v2.0]

i will make video about this but in these Pictures you can See C# Method Executed in-memory by Creating New Thread via CreateThread API Directly .

i talked about this Technique before but in that time i talked about this trick via Callback API Functions which you can see in this old article : https://damonmohammadbagher.github.io/Posts/29mar2021x.html

but in these new Pictures you can see that trick but in this time i used CreateThread API instead Callback functions to run Managed code (C# Method) via Windows Native API...

in this code you can see New Thread Created by CreateThread and in this case Managed code executed in-memory (instead native code) by CreateThread and you can see in C# Method we have Delay which means that New Thread Created and Wait for secs and then will run next Managed code lines in-memory with delay so this will help you to bypass some defensive tools like AVs sometimes ;p ....

this technique/trick will help you to control your managed code via Native Apis to create or pause them via Windows Native Apis like CreateThread or SuspendThread or Wow64SuspendThread or ... also you can pause that thread in-memory by apis Then your C2 server connection will stop for secs which you want and again you and resume thread to active connection without creating any new thread or code or .... when that thread is pause in-memory almost all Anti-viruses will not check that start-address in memory but i think probably you can change their memory bytes by encryption and again decrypt that before resume that (thread) and ...
#redteam #blueteam #pentesting #ebook #csharp #soc #threatdetection #inmemory #scanners