hsheric0210
diff --git a/‎lib/ShellcodeConverter/Program.cs‎
Lines changed: 92 additions & 2 deletions b/‎lib/ShellcodeConverter/Program.cs‎
Lines changed: 92 additions & 2 deletions
diff --git a/‎lib/ShellcodeConverter/ShellcodeConverter.csproj‎
Lines changed: 10 additions & 0 deletions b/‎lib/ShellcodeConverter/ShellcodeConverter.csproj‎
Lines changed: 10 additions & 0 deletions
@@ -1,12 +1,102 @@
-using System;
+using StealthModule;
+using StealthModule.Native.PE;
+using System;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Runtime.InteropServices;
+using System.Text.RegularExpressions;
 
 namespace ShellcodeConverter
 {
     internal class Program
     {
+        private static void PrintSyntax()
+        {
+            Console.WriteLine("ShellCodeConverter (Out-Shellcode.ps1 ported to C# and StealthModule.NET) [original Out-Shellcode.ps1 by Matt Graeber @mattifestation]");
+            Console.WriteLine("Syntax: ShellcodeConverter <input PE file path> <input .map file> <output file path>");
+        }
+
         static void Main(string[] args)
         {
-            Console.WriteLine("Hello, World!");
+            if (args.Length != 3)
+            {
+                PrintSyntax();
+                return;
+            }
+
+            var inputPEFile = args[0];
+            var inputMapFile = args[1];
+            var outputFile = args[2];
+
+            if (!File.Exists(inputPEFile))
+            {
+                Console.WriteLine("Input PE file does not exist.");
+                return;
+            }
+
+            if (!File.Exists(inputMapFile))
+            {
+                Console.WriteLine("Input .map file does not exist.");
+                return;
+            }
+
+            var peBytes = File.ReadAllBytes(inputPEFile);
+            var peBuffer = Marshal.AllocHGlobal(peBytes.Length);
+            try
+            {
+                Marshal.Copy(peBytes, 0, peBuffer, peBytes.Length);
+                var header = new PEHeader(peBuffer);
+
+                var found = false;
+                ImageSectionHeader textSection = default;
+                foreach (var section in header.Sections)
+                {
+                    var sectionName = Structs.LongTo8byteString(section.Name);
+                    Console.WriteLine("Section: " + sectionName);
+                    if (sectionName.StartsWith(".text", StringComparison.Ordinal))
+                    {
+                        found = true;
+                        textSection = section;
+                        break;
+                    }
+                }
+
+                if (!found)
+                {
+                    Console.WriteLine("'.text' section not found.");
+                    return;
+                }
+
+                var lineMatcher = new Regex(@".*([\dabcdef]{8})H.*\.text(?:\$\w+)?.*\W+CODE", RegexOptions.Compiled, TimeSpan.FromMilliseconds(100));
+                var mapLines = File.ReadAllLines(inputMapFile);
+                var textSectionLengthText = mapLines
+                    .Select(line => lineMatcher.Match(line))
+                    .Where(match => match.Success)
+                    .Select(match => match.Groups[1].Value)
+                    .FirstOrDefault();
+
+                Console.WriteLine("'.text' section length is " + textSectionLengthText);
+
+                if (textSectionLengthText == null || !int.TryParse(textSectionLengthText, NumberStyles.HexNumber, NumberFormatInfo.CurrentInfo, out var shellCodeLength))
+                {
+                    Console.WriteLine("'.text' section length is unavailable. (" + textSectionLengthText + ")");
+                    return;
+                }
+
+                var shellCode = new byte[shellCodeLength];
+                var textSectionBegin = textSection.PointerToRawData;
+                Buffer.BlockCopy(peBytes, (int)textSectionBegin, shellCode, 0, shellCodeLength);
+
+                Console.WriteLine("Shellcode extracted: offset=" + textSectionBegin + " length=" + shellCodeLength);
+
+                File.WriteAllBytes(outputFile, shellCode);
+                Console.WriteLine("Done writing to " + outputFile);
+            }
+            finally
+            {
+                Marshal.FreeHGlobal(peBuffer);
+            }
         }
     }
 }
@@ -6,4 +6,14 @@
         <Platforms>x64;x86</Platforms>
     </PropertyGroup>
 
+    <ItemGroup>
+      <PackageReference Include="Costura.Fody" Version="5.7.0">
+        <PrivateAssets>all</PrivateAssets>
+        <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+      </PackageReference>
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\..\StealthModule\StealthModule.csproj" />
+    </ItemGroup>
 </Project>