- Not really an evasion medium, more of a built-in way to access unmanaged code (ie: C/C++) via managed code (C#)
- Import Dlls and create functions signatures for the function you wish to call. Below is an example of using Pinvoke so I can call CreateThread in C#.
[DllImport("kernel32.dll")]
static extern IntPtr CreateThread(
IntPtr lpThreadAttributes,
uint dwStackSize,
IntPtr lpStartAddress,
IntPtr lpParameter,
uint dwCreationFlags,
IntPtr lpThreadId);
- To generate the function signature, refer to pinvoke.net or read the microsoft documentation on the method call and yolo the determining of the datatypes.
Pros
- Easy, simple access to any API exported by a DLL
Cons
- An entry is made in the import address table (IAT) of the executeable, making it super easy to get flagged by AV & EDR
- The APIs we import are potentially hooked