What subprojects are included in the Donut source code, and what role does each play in testing or generating shellcode?
The Donut v0.9 source includes several key subprojects: `DemoCreateProcess` produces a test DLL (ClassLibrary.dll) that launches a process; `DonutTest` injects shellcode into a target process using `CreateRemoteThread`; `rundotnet.cpp` loads .NET assemblies from memory via CLR for testing; `ModuleMonitor` detects CLR injection using WMI events; and `ProcessManager` enumerates processes and checks for CLR presence. The main `donut.c` assembly converts .NET assemblies into shellcode. These components together enable end‑to‑end testing and validation, as described in the article.
DemoCreateProcessDonutTestrundotnetModuleMonitorProcessManagerdonut.cCLR injection detection