dotNetPELoader-v1.0.0

A C# PE loader for both x64 and x86 PE file.

Recently, when I was developing a fileless execution method for DuplexSpy RAT, I could hardly find a C#-based x86 PE loader.
Most existing implementations I found were x64-only, such as the one developed by Casey Smith
.
Therefore, I decided to develop a C#-based x86 PE loader myself.

This console application allows you to load either x86 or x64 PE files into memory.
First, it reads the file bytes from the specified file path, then determines the architecture of both the loader and the target PE file.

An x64 PE cannot be loaded by an x86 loader, and vice versa.

Usage

dotNetPELoader.exe --x64 x64_file.exe
dotNetPELoader.exe --x86 x86_file.exe
dotNetPELoader.exe --coffee