donut
donut copied to clipboard
Handle machine mismatch with IL_ONLY assemblies
Hello, thanks for creating donut.
I was running some x64 donut shellcode from the context of an IL Only (AnyCpu) PE32 .NET assembly on a 64-bit machine. The shellcode would not complete execution.
Digging a bit deeper, I discovered it was returning prematurely from here: https://github.com/TheWover/donut/blob/master/loader/inmem_pe.c#L107
IL Only images are PE32 on disk but may be transformed to PE32+ in memory by _CorValidateImage.
I have added a small fix to handle this case.
Thanks!
good find
this just saved my life, it needs to be merged! 👍