One Day Sec

What modifications were made to PELoader.cs to support 32-bit executables and older .NET versions?

To support .NET 3.5, the `.Add()` method was replaced with alternative collection initialization syntax. For 32-bit support, the code now checks the `Characteristics` field in `IMAGE_FILE_HEADER` to determine whether the PE is 32-bit (`IMAGE_FILE_32BIT_MACHINE`) and recalculates offsets accordingly using the 32-bit PE structures. The extended versions, named `SharpMimikatz_x86.cs` and `SharpMimikatz_x64.cs`, can be compiled with the appropriate `csc.exe` and platform flags.
32-bit.NET 3.5IMAGE_FILE_HEADERIMAGE_FILE_32BIT_MACHINESharpMimikatz

Browse all Q&A →