查看原文
其他

net反射

yicunyiye 红队蓝军 2023-03-20

1.1 查找dll文件

using System.Reflection;
Assembly.Load()
Assembly.LoadFrom()
Assembly.LoadFile()

Load需要把dll放到程序当前路径加载,也可以读取字符串形式。LoadFrom需要写全路径,如果test1.dll引用了test2.dll,同时也会加载test2.dll进来。LoadFile不会加载test2.dll。

Assembly assembly1 = Assembly.Load("DllTest");
Assembly assembly2 = Assembly.LoadFile(@"C:\Users\Administrator\Desktop\c#\learn\reflection2\DllTest\bin\Release\DllTest.dll");
Assembly assembly3 = Assembly.LoadFrom(@"C:\Users\Administrator\Desktop\c#\learn\reflection2\DllTest\bin\Release\DllTest.dll");
Assembly assembly4 = Assembly.LoadFrom("DllTest.dll");

1.2 调用构造函数

首先写一个DllTest.dll

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;

namespace DllTest
{
    public class Class1
    {
        public Class1()
        {
            Console.WriteLine("no params");
        }

        public Class1(string name)
        {
            Console.WriteLine($"have params value is {name}");
        }
    }
}

前面我们已经加载了dll文件,但是可能会存在多个类,所以我们要获取指定类型。

Type type = assembly.GetType("DllTest.Class1");

然后动态的实例化对象

Object obj = Activator.CreateInstance(type);

调用参数构造方法

Object obj = Activator.CreateInstance(type,new Object[] {"test"});

如何调用私有的构造函数

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;

namespace DllTest
{
    public class Class1
    {
        private Class1()
        {
            Console.WriteLine("no params");
        }

        public Class1(string name)
        {
            Console.WriteLine($"have params value is {name}");
        }
    }
}

在CreateInstance方法第二个参数设置为true即可

Assembly assembly = Assembly.LoadFrom("DllTest.dll");
Type type = assembly.GetType("DllTest.Class1");
Object obj = Activator.CreateInstance(type,true);

1.3 查找所有类,构造方法和参数

很多时候我们得到一个dll文件但是不知道里面存在哪些类 我们在DllTest.dll再创建一个类。

Assembly assembly = Assembly.LoadFrom("DllTest.dll");
foreach(var all_type in assembly.GetTypes())
{
    Console.WriteLine(all_type.Name);
}

当我们获取到类后,再获取所有的构造方法

Type type = assembly.GetType("DllTest.Class1");
foreach(var all_cons in type.GetConstructors())
{
    Console.WriteLine(all_cons);
}

如果我们要获取构造方法里面的参数

Assembly assembly = Assembly.LoadFrom("DllTest.dll");
foreach(var all_type in assembly.GetTypes())
{
    Console.WriteLine("类:"+all_type.Name);
}
Type type = assembly.GetType("DllTest.Class1");
foreach(var all_cons in type.GetConstructors())
{
    Console.WriteLine("构造方法:"+all_cons);
    foreach(var param in all_cons.GetParameters())
    {
        Console.WriteLine("所有参数:"+param.Name);
    }
}

但是这里可以看到private没有显示出来,我们加参数即可。

static void Main(string[] args)
{
    Assembly assembly = Assembly.LoadFrom("DllTest.dll");
    foreach(var all_type in assembly.GetTypes())
    {
        Console.WriteLine("类:"+all_type.Name);
    }
    Type type = assembly.GetType("DllTest.Class1");
    foreach(var all_cons in type.GetConstructors(BindingFlags.Instance | BindingFlags.Public | BindingFlags.NonPublic))
    {
        Console.WriteLine("构造方法:"+all_cons);
        foreach(var param in all_cons.GetParameters())
        {
            Console.WriteLine("所有参数:"+param.Name);
        }
    }
}

1.4 调用方法

在DllTest添加一个普通方法和一个私有方法

public void TestMethod()
{
    Console.WriteLine("TestMethod");
}

先获取所有方法

var methods = type.GetMethods(BindingFlags.Instance|BindingFlags.Public|BindingFlags.NonPublic);
foreach(var method in methods)
{
    Console.WriteLine(method);
    Console.WriteLine(method.Attributes);
}

可以看到TetMethod方法为public,TestMethod2方法为private。

调用TestMethod方法,就算我们知道这个方法里面没有参数但是还是要new一个空数组,如果有参数写进去即可。

var method = type.GetMethod("TestMethod");
method.Invoke(obj,new object[] {});

调用TestMethod2方法。

var method = type.GetMethod("TestMethod2",BindingFlags.Public|BindingFlags.NonPublic|BindingFlags.Instance);
method.Invoke(obj,new object[] {});

1.5 调用泛型方法

先在DllTest添加两个泛型方法

public void Test<T>()
{
    Console.WriteLine("Test");
}

public void Test2<T>(string name)
{
    Console.WriteLine($"name is:{name}");
}
var method = type.GetMethod("Test"); //获取方法
var genericMethod = method.MakeGenericMethod(new Type[] {typeof(int)}); //指定泛型参数类型(前面的T)
genericMethod.Invoke(obj, new object[] { });

有参数

var method = type.GetMethod("Test2");
var genericMethod = method.MakeGenericMethod(new Type[] {typeof(string)});
genericMethod.Invoke(obj, new object[] {"jjjj"});

1.6 操作属性

DllTest创建一个Pro类

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;

namespace DllTest
{
    public class Pro
    {
        public string name { getset; }
        public int num { getset; }
    }
}

先获取所有属性

Assembly assembly = Assembly.LoadFrom("DllTest.dll");
Type type = assembly.GetType("DllTest.Pro");
object obj = Activator.CreateInstance(type);
foreach(var property in type.GetProperties())
{
    Console.WriteLine(property.Name);
}

设置属性和获取属性

Assembly assembly = Assembly.LoadFrom("DllTest.dll");
Type type = assembly.GetType("DllTest.Pro");
object obj = Activator.CreateInstance(type);
foreach(var property in type.GetProperties())
{
    //Console.WriteLine(property.Name);
    if (property.Name.Equals("name"))
    {
        property.SetValue(obj, "zhangsan");
    }else if (property.Name.Equals("num"))
    {
        property.SetValue(obj, 123123);
    }

    Console.WriteLine(property.GetValue(obj));
}

1.7 利用

DllTest添加TestCalc类

using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Linq;
using System.Text;

namespace DllTest
{
    public class TestCalc
    {
        public static void Start()
        {
            Process p = new Process();
            p.StartInfo.FileName = "c:\\windows\\system32\\calc.exe";
            p.Start();
        }
    }
}
using System;
using System.Collections.Generic;
using System.Linq;
using System.Reflection;
using System.Text;

namespace reflection2
{
    internal class Program
    {
        static void Main(string[] args)
        {
            Assembly assembly = Assembly.LoadFrom("DllTest.dll");
            Type type = assembly.GetType("DllTest.TestCalc");
            var method = type.GetMethod("Start");
            method.Invoke(type,null);
        }
    }

前面我们说了Assembly.Load()可以从string类型加载程序集。新建testcalc项目

using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Linq;
using System.Text;

namespace testcalc
{
    internal class Program
    {
        static void Main(string[] args)
        {
            Console.WriteLine("test");
        }
    }
    public class Strat
    {
        public static void run()
        {
                Process p = new Process();
                p.StartInfo.FileName = "c:\\windows\\system32\\calc.exe";
                p.Start();
        }
    }
}

然后使用File.ReadAllBytes讲testcalc.exe转换为string类型

using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;

namespace readCalc
{
    internal class Program
    {
        static void Main(string[] args)
        {
            byte[] buffer = File.ReadAllBytes("testcalc.exe");
            string base64str = Convert.ToBase64String(buffer);
            Console.WriteLine(base64str);
        }
    }
}

结果

TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAI+UC8QAAAAAAAAAAOAAIgALATAAAAgAAAAIAAAAAAAAsicAAAAgAAAAQAAAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAMAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAF4nAABPAAAAAEAAALwFAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAACwJgAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAuAcAAAAgAAAACAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAALwFAAAAQAAAAAYAAAAKAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAEAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACSJwAAAAAAAEgAAAACAAUAjCAAACQGAAABAAAAAQAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5yAQAAcCgOAAAKKh4CKA8AAAoqcnMQAAAKJW8RAAAKcgsAAHBvEgAACm8TAAAKJioeAigPAAAKKgAAAEJTSkIBAAEAAAAAAAwAAAB2Mi4wLjUwNzI3AAAAAAUAbAAAABwCAAAjfgAAiAIAAGQCAAAjU3RyaW5ncwAAAADsBAAASAAAACNVUwA0BQAAEAAAACNHVUlEAAAARAUAAOAAAAAjQmxvYgAAAAAAAAACAAABRxUAAAkAAAAA+gEzABYAAAEAAAASAAAAAwAAAAQAAAABAAAAEwAAAA0AAAABAAAAAgAAAAAAhwEBAAAAAAAGAPwAFQIGAGkBFQIGAEkA4wEPADUCAAAGAHEAqAEGAN8AqAEGAMAAqAEGAFABqAEGABwBqAEGADUBqAEGAIgAqAEGAF0A9gEGADsA9gEGAKMAqAEGAFcCnAEGABwAnAEKAEkC4wEKAMwB4wEAAAAAAQAAAAAAAQABAAAAEACUARMAPQABAAEAAQAQAFECEwA9AAEAAwBQIAAAAACRAKMBMQABAFwgAAAAAIYY3QEGAAIAZCAAAAAAlgC6ATcAAgCBIAAAAACGGN0BBgACAAAAAQBEAgkA3QEBABEA3QEGABkA3QEKACkA3QEQADEA3QEQADkA3QEQAEEA3QEQAEkA3QEQAFEA3QEQAFkA3QEQAGEA3QEVAGkA3QEQAHEA3QEQAIEAMQAaAHkA3QEGAIkA3QEGAIkAvgEfAJEAJAAQAIkAXgIkAC4ACwA7AC4AEwBEAC4AGwBjAC4AIwBsAC4AKwB6AC4AMwB6AC4AOwCAAC4AQwBsAC4ASwCKAC4AUwB6AC4AWwB6AC4AYwCmAC4AawDQAASAAAABAAAAAAAAAAAAAAAAABMAAAACAAAAAAAAAAAAAAAoAAoAAAAAAAIAAAAAAAAAAAAAACgAnAEAAAAAAAAAAAA8TW9kdWxlPgBtc2NvcmxpYgB0ZXN0Y2FsYwBDb25zb2xlAHNldF9GaWxlTmFtZQBXcml0ZUxpbmUAR3VpZEF0dHJpYnV0ZQBEZWJ1Z2dhYmxlQXR0cmlidXRlAENvbVZpc2libGVBdHRyaWJ1dGUAQXNzZW1ibHlUaXRsZUF0dHJpYnV0ZQBBc3NlbWJseVRyYWRlbWFya0F0dHJpYnV0ZQBBc3NlbWJseUZpbGVWZXJzaW9uQXR0cmlidXRlAEFzc2VtYmx5Q29uZmlndXJhdGlvbkF0dHJpYnV0ZQBBc3NlbWJseURlc2NyaXB0aW9uQXR0cmlidXRlAENvbXBpbGF0aW9uUmVsYXhhdGlvbnNBdHRyaWJ1dGUAQXNzZW1ibHlQcm9kdWN0QXR0cmlidXRlAEFzc2VtYmx5Q29weXJpZ2h0QXR0cmlidXRlAEFzc2VtYmx5Q29tcGFueUF0dHJpYnV0ZQBSdW50aW1lQ29tcGF0aWJpbGl0eUF0dHJpYnV0ZQB0ZXN0Y2FsYy5leGUAUHJvZ3JhbQBTeXN0ZW0ATWFpbgBTeXN0ZW0uUmVmbGVjdGlvbgBydW4AZ2V0X1N0YXJ0SW5mbwBQcm9jZXNzU3RhcnRJbmZvAC5jdG9yAFN5c3RlbS5EaWFnbm9zdGljcwBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMAU3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcwBEZWJ1Z2dpbmdNb2RlcwBhcmdzAFByb2Nlc3MAU3RyYXQAT2JqZWN0AFN0YXJ0AAAJdABlAHMAdAAAOWMAOgBcAHcAaQBuAGQAbwB3AHMAXABzAHkAcwB0AGUAbQAzADIAXABjAGEAbABjAC4AZQB4AGUAAAAAAKvZBVsQHUlPtzbq2L1Juv4ABCABAQgDIAABBSABARERBCABAQ4EIAEBAgQAAQEOBCAAEkkDIAACCLd6XFYZNOCJBQABAR0OAwAAAQgBAAgAAAAAAB4BAAEAVAIWV3JhcE5vbkV4Y2VwdGlvblRocm93cwEIAQACAAAAAAANAQAIdGVzdGNhbGMAAAUBAAAAAAkBAARIb21lAAAbAQAWQ29weXJpZ2h0IMKpIEhvbWUgMjAyMgAAKQEAJDA4MjYxNzk2LTQ5NzctNGI0NC05ZjYxLWJhODljYjFhZjE3ZAAADAEABzEuMC4wLjAAAAAAAAAAAABfvfnEAAAAAAIAAAB2AAAA6CYAAOgIAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAUlNEU5XHczf386JKmzhsBr4bkvQBAAAAQzpcVXNlcnNcQWRtaW5pc3RyYXRvclxEZXNrdG9wXGMjXGxlYXJuXHJlZmxlY3Rpb25cdGVzdGNhbGNcdGVzdGNhbGNcb2JqXFJlbGVhc2VcdGVzdGNhbGMucGRiAIYnAAAAAAAAAAAAAKAnAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAACSJwAAAAAAAAAAAAAAAF9Db3JFeGVNYWluAG1zY29yZWUuZGxsAAAAAAAAAP8lACBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAQAAAAIAAAgBgAAABQAACAAAAAAAAAAAAAAAAAAAABAAEAAAA4AACAAAAAAAAAAAAAAAAAAAABAAAAAACAAAAAAAAAAAAAAAAAAAAAAAABAAEAAABoAACAAAAAAAAAAAAAAAAAAAABAAAAAAC8AwAAkEAAACwDAAAAAAAAAAAAACwDNAAAAFYAUwBfAFYARQBSAFMASQBPAE4AXwBJAE4ARgBPAAAAAAC9BO/+AAABAAAAAQAAAAAAAAABAAAAAAA/AAAAAAAAAAQAAAABAAAAAAAAAAAAAAAAAAAARAAAAAEAVgBhAHIARgBpAGwAZQBJAG4AZgBvAAAAAAAkAAQAAABUAHIAYQBuAHMAbABhAHQAaQBvAG4AAAAAAAAAsASMAgAAAQBTAHQAcgBpAG4AZwBGAGkAbABlAEkAbgBmAG8AAABoAgAAAQAwADAAMAAwADAANABiADAAAAAaAAEAAQBDAG8AbQBtAGUAbgB0AHMAAAAAAAAAKgAFAAEAQwBvAG0AcABhAG4AeQBOAGEAbQBlAAAAAABIAG8AbQBlAAAAAAA6AAkAAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAdABlAHMAdABjAGEAbABjAAAAAAAwAAgAAQBGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADEALgAwAC4AMAAuADAAAAA6AA0AAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAHQAZQBzAHQAYwBhAGwAYwAuAGUAeABlAAAAAABQABYAAQBMAGUAZwBhAGwAQwBvAHAAeQByAGkAZwBoAHQAAABDAG8AcAB5AHIAaQBnAGgAdAAgAKkAIABIAG8AbQBlACAAMgAwADIAMgAAACoAAQABAEwAZQBnAGEAbABUAHIAYQBkAGUAbQBhAHIAawBzAAAAAAAAAAAAQgANAAEATwByAGkAZwBpAG4AYQBsAEYAaQBsAGUAbgBhAG0AZQAAAHQAZQBzAHQAYwBhAGwAYwAuAGUAeABlAAAAAAAyAAkAAQBQAHIAbwBkAHUAYwB0AE4AYQBtAGUAAAAAAHQAZQBzAHQAYwBhAGwAYwAAAAAANAAIAAEAUAByAG8AZAB1AGMAdABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAADgACAABAEEAcwBzAGUAbQBiAGwAeQAgAFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAzEMAAOoBAAAAAAAAAAAAAO+7vzw/eG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IlVURi04IiBzdGFuZGFsb25lPSJ5ZXMiPz4NCg0KPGFzc2VtYmx5IHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgbWFuaWZlc3RWZXJzaW9uPSIxLjAiPg0KICA8YXNzZW1ibHlJZGVudGl0eSB2ZXJzaW9uPSIxLjAuMC4wIiBuYW1lPSJNeUFwcGxpY2F0aW9uLmFwcCIvPg0KICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MiI+DQogICAgPHNlY3VyaXR5Pg0KICAgICAgPHJlcXVlc3RlZFByaXZpbGVnZXMgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj4NCiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsIGxldmVsPSJhc0ludm9rZXIiIHVpQWNjZXNzPSJmYWxzZSIvPg0KICAgICAgPC9yZXF1ZXN0ZWRQcml2aWxlZ2VzPg0KICAgIDwvc2VjdXJpdHk+DQogIDwvdHJ1c3RJbmZvPg0KPC9hc3NlbWJseT4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAMAAAAtDcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

然后再使用Assembly.Load加载string反射调用Strat类的run方法

using System;
using System.Collections.Generic;
using System.Linq;
using System.Reflection;
using System.Text;

namespace Loader
{
    internal class Program
    {
        static void Main(string[] args)
        {
            string base64str = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAI+UC8QAAAAAAAAAAOAAIgALATAAAAgAAAAIAAAAAAAAsicAAAAgAAAAQAAAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAMAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAF4nAABPAAAAAEAAALwFAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAACwJgAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAuAcAAAAgAAAACAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAALwFAAAAQAAAAAYAAAAKAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAEAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACSJwAAAAAAAEgAAAACAAUAjCAAACQGAAABAAAAAQAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5yAQAAcCgOAAAKKh4CKA8AAAoqcnMQAAAKJW8RAAAKcgsAAHBvEgAACm8TAAAKJioeAigPAAAKKgAAAEJTSkIBAAEAAAAAAAwAAAB2Mi4wLjUwNzI3AAAAAAUAbAAAABwCAAAjfgAAiAIAAGQCAAAjU3RyaW5ncwAAAADsBAAASAAAACNVUwA0BQAAEAAAACNHVUlEAAAARAUAAOAAAAAjQmxvYgAAAAAAAAACAAABRxUAAAkAAAAA+gEzABYAAAEAAAASAAAAAwAAAAQAAAABAAAAEwAAAA0AAAABAAAAAgAAAAAAhwEBAAAAAAAGAPwAFQIGAGkBFQIGAEkA4wEPADUCAAAGAHEAqAEGAN8AqAEGAMAAqAEGAFABqAEGABwBqAEGADUBqAEGAIgAqAEGAF0A9gEGADsA9gEGAKMAqAEGAFcCnAEGABwAnAEKAEkC4wEKAMwB4wEAAAAAAQAAAAAAAQABAAAAEACUARMAPQABAAEAAQAQAFECEwA9AAEAAwBQIAAAAACRAKMBMQABAFwgAAAAAIYY3QEGAAIAZCAAAAAAlgC6ATcAAgCBIAAAAACGGN0BBgACAAAAAQBEAgkA3QEBABEA3QEGABkA3QEKACkA3QEQADEA3QEQADkA3QEQAEEA3QEQAEkA3QEQAFEA3QEQAFkA3QEQAGEA3QEVAGkA3QEQAHEA3QEQAIEAMQAaAHkA3QEGAIkA3QEGAIkAvgEfAJEAJAAQAIkAXgIkAC4ACwA7AC4AEwBEAC4AGwBjAC4AIwBsAC4AKwB6AC4AMwB6AC4AOwCAAC4AQwBsAC4ASwCKAC4AUwB6AC4AWwB6AC4AYwCmAC4AawDQAASAAAABAAAAAAAAAAAAAAAAABMAAAACAAAAAAAAAAAAAAAoAAoAAAAAAAIAAAAAAAAAAAAAACgAnAEAAAAAAAAAAAA8TW9kdWxlPgBtc2NvcmxpYgB0ZXN0Y2FsYwBDb25zb2xlAHNldF9GaWxlTmFtZQBXcml0ZUxpbmUAR3VpZEF0dHJpYnV0ZQBEZWJ1Z2dhYmxlQXR0cmlidXRlAENvbVZpc2libGVBdHRyaWJ1dGUAQXNzZW1ibHlUaXRsZUF0dHJpYnV0ZQBBc3NlbWJseVRyYWRlbWFya0F0dHJpYnV0ZQBBc3NlbWJseUZpbGVWZXJzaW9uQXR0cmlidXRlAEFzc2VtYmx5Q29uZmlndXJhdGlvbkF0dHJpYnV0ZQBBc3NlbWJseURlc2NyaXB0aW9uQXR0cmlidXRlAENvbXBpbGF0aW9uUmVsYXhhdGlvbnNBdHRyaWJ1dGUAQXNzZW1ibHlQcm9kdWN0QXR0cmlidXRlAEFzc2VtYmx5Q29weXJpZ2h0QXR0cmlidXRlAEFzc2VtYmx5Q29tcGFueUF0dHJpYnV0ZQBSdW50aW1lQ29tcGF0aWJpbGl0eUF0dHJpYnV0ZQB0ZXN0Y2FsYy5leGUAUHJvZ3JhbQBTeXN0ZW0ATWFpbgBTeXN0ZW0uUmVmbGVjdGlvbgBydW4AZ2V0X1N0YXJ0SW5mbwBQcm9jZXNzU3RhcnRJbmZvAC5jdG9yAFN5c3RlbS5EaWFnbm9zdGljcwBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMAU3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcwBEZWJ1Z2dpbmdNb2RlcwBhcmdzAFByb2Nlc3MAU3RyYXQAT2JqZWN0AFN0YXJ0AAAJdABlAHMAdAAAOWMAOgBcAHcAaQBuAGQAbwB3AHMAXABzAHkAcwB0AGUAbQAzADIAXABjAGEAbABjAC4AZQB4AGUAAAAAAKvZBVsQHUlPtzbq2L1Juv4ABCABAQgDIAABBSABARERBCABAQ4EIAEBAgQAAQEOBCAAEkkDIAACCLd6XFYZNOCJBQABAR0OAwAAAQgBAAgAAAAAAB4BAAEAVAIWV3JhcE5vbkV4Y2VwdGlvblRocm93cwEIAQACAAAAAAANAQAIdGVzdGNhbGMAAAUBAAAAAAkBAARIb21lAAAbAQAWQ29weXJpZ2h0IMKpIEhvbWUgMjAyMgAAKQEAJDA4MjYxNzk2LTQ5NzctNGI0NC05ZjYxLWJhODljYjFhZjE3ZAAADAEABzEuMC4wLjAAAAAAAAAAAABfvfnEAAAAAAIAAAB2AAAA6CYAAOgIAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAUlNEU5XHczf386JKmzhsBr4bkvQBAAAAQzpcVXNlcnNcQWRtaW5pc3RyYXRvclxEZXNrdG9wXGMjXGxlYXJuXHJlZmxlY3Rpb25cdGVzdGNhbGNcdGVzdGNhbGNcb2JqXFJlbGVhc2VcdGVzdGNhbGMucGRiAIYnAAAAAAAAAAAAAKAnAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAACSJwAAAAAAAAAAAAAAAF9Db3JFeGVNYWluAG1zY29yZWUuZGxsAAAAAAAAAP8lACBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAQAAAAIAAAgBgAAABQAACAAAAAAAAAAAAAAAAAAAABAAEAAAA4AACAAAAAAAAAAAAAAAAAAAABAAAAAACAAAAAAAAAAAAAAAAAAAAAAAABAAEAAABoAACAAAAAAAAAAAAAAAAAAAABAAAAAAC8AwAAkEAAACwDAAAAAAAAAAAAACwDNAAAAFYAUwBfAFYARQBSAFMASQBPAE4AXwBJAE4ARgBPAAAAAAC9BO/+AAABAAAAAQAAAAAAAAABAAAAAAA/AAAAAAAAAAQAAAABAAAAAAAAAAAAAAAAAAAARAAAAAEAVgBhAHIARgBpAGwAZQBJAG4AZgBvAAAAAAAkAAQAAABUAHIAYQBuAHMAbABhAHQAaQBvAG4AAAAAAAAAsASMAgAAAQBTAHQAcgBpAG4AZwBGAGkAbABlAEkAbgBmAG8AAABoAgAAAQAwADAAMAAwADAANABiADAAAAAaAAEAAQBDAG8AbQBtAGUAbgB0AHMAAAAAAAAAKgAFAAEAQwBvAG0AcABhAG4AeQBOAGEAbQBlAAAAAABIAG8AbQBlAAAAAAA6AAkAAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAdABlAHMAdABjAGEAbABjAAAAAAAwAAgAAQBGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADEALgAwAC4AMAAuADAAAAA6AA0AAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAHQAZQBzAHQAYwBhAGwAYwAuAGUAeABlAAAAAABQABYAAQBMAGUAZwBhAGwAQwBvAHAAeQByAGkAZwBoAHQAAABDAG8AcAB5AHIAaQBnAGgAdAAgAKkAIABIAG8AbQBlACAAMgAwADIAMgAAACoAAQABAEwAZQBnAGEAbABUAHIAYQBkAGUAbQBhAHIAawBzAAAAAAAAAAAAQgANAAEATwByAGkAZwBpAG4AYQBsAEYAaQBsAGUAbgBhAG0AZQAAAHQAZQBzAHQAYwBhAGwAYwAuAGUAeABlAAAAAAAyAAkAAQBQAHIAbwBkAHUAYwB0AE4AYQBtAGUAAAAAAHQAZQBzAHQAYwBhAGwAYwAAAAAANAAIAAEAUAByAG8AZAB1AGMAdABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAADgACAABAEEAcwBzAGUAbQBiAGwAeQAgAFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAzEMAAOoBAAAAAAAAAAAAAO+7vzw/eG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IlVURi04IiBzdGFuZGFsb25lPSJ5ZXMiPz4NCg0KPGFzc2VtYmx5IHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgbWFuaWZlc3RWZXJzaW9uPSIxLjAiPg0KICA8YXNzZW1ibHlJZGVudGl0eSB2ZXJzaW9uPSIxLjAuMC4wIiBuYW1lPSJNeUFwcGxpY2F0aW9uLmFwcCIvPg0KICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MiI+DQogICAgPHNlY3VyaXR5Pg0KICAgICAgPHJlcXVlc3RlZFByaXZpbGVnZXMgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj4NCiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsIGxldmVsPSJhc0ludm9rZXIiIHVpQWNjZXNzPSJmYWxzZSIvPg0KICAgICAgPC9yZXF1ZXN0ZWRQcml2aWxlZ2VzPg0KICAgIDwvc2VjdXJpdHk+DQogIDwvdHJ1c3RJbmZvPg0KPC9hc3NlbWJseT4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAMAAAAtDcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
            byte[] buffer = Convert.FromBase64String(base64str);
            Assembly assembly = Assembly.Load(buffer);
            Type type = assembly.GetType("testcalc.Strat");
            MethodInfo method = type.GetMethod("run");
            Object obj = assembly.CreateInstance(method.Name);
            method.Invoke(obj, new object[] { });
        }
    }
}

加下方wx,拉你一起进群学习

往期推荐

x64下隐藏可执行内存

firefox批量get password

内核APC&用户APC详解

Demo版菜刀

浅谈EDR绕过

tomcat原理刨析之手写tomcat

ETW的攻与防

什么?你还不会webshell免杀?(四)


您可能也对以下帖子感兴趣

文章有问题?点此查看未经处理的缓存