One Day Sec

How does Casey Smith's PELoader.cs work and what limitations did the article address?

PELoader.cs encodes a compressed 64-bit version of mimikatz.exe as a base64 string and loads it into memory using the steps described above. The original code uses `.Add()` which is incompatible with .NET 3.5, and it only supports 64-bit executables. The article extended PELoader.cs to support both 32-bit and 64-bit PE files and to compile under .NET 3.5 or higher by replacing `.Add()` and distinguishing PE structures via the `IMAGE_FILE_HEADER` characteristics.
PELoadermimikatz.NET 3.532-bit64-bitcsc.exe

Browse all Q&A →