Rubeus

Flowchart of the WasmForge C# build pipeline. C# source from Rubeus, Seatbelt, and SharpDPAPI enters a build-time transformation stage, where csharp_patcher applies source transforms and routes BCL calls to WasmForge helpers, and pinvoke_scanner routes P/Invokes to C bridge sources, with residual stubs left for architectural holes. Output flows through dotnet publish, wasm-component-ld, a .wasm module, and the WasmForge host to a final signed PE.

GhostPack Necromancy: Reforging C# Tools with WasmForge

| | C++, EDR evasion, GhostPack, NativeAOT, Offensive Security, Red Teaming, Rubeus, Seatbelt, Tools & Techniques, Vulnerability Research, WasmForge, WebAssembly
In the previous post we walked through WasmForge, our Go-to-WebAssembly loader that takes existing signatured Go tools and ships them as opsec-safe binaries. This approach doesn’t just apply to Go, however, as ...
Offensive Security Blog: Latest Trends in Hacking | Praetorian