iss4cf0ng/dotnetpeloaderA C# PE loader for x64 and x86 PE files.
Recently, I discovered an unofficial modified version of this project being redistributed outside of this repository.
After reviewing the files, I identified additional hidden components and script-loading behavior that do NOT exist in the official source code.
Please be aware:
I am not affiliated with any third-party redistribution of this project.
For safety reasons:
PoC for analysis: https://iss4cf0ng.github.io/2026/02/24/2026-2-24-UnofficialRedistribution/
A C# PE loader for x64 and x86 PE files.
Recently, when I was developing a fileless execution method for DuplexSpy RAT version 2, I could hardly find a C#-based x86 PE loader.
Most existing implementations I found were x64-only, such as the one developed by Casey Smith
.
Therefore, I decided to develop a C#-based x86 PE loader myself.
This console application allows you to load either x86 or x64 PE files into memory. First, it reads the file bytes from the specified file path, then determines the architecture of both the loader and the target PE file.
An x64 PE cannot be loaded by an x86 loader, and vice versa.
If you find this project useful, a ⭐ would be appreciated.
dotNetPELoader.exe --x64 x64_file.exe
dotNetPELoader.exe --x86 x86_file.exe
dotNetPELoader.exe --coffee
If you try to load an x86 PE while the loader is an x64 loader, an exception will be thrown:
dotNetPELoader.exe --x64 mimikatz
dotNetPELoader.exe --x86 mimikatz
