SafeArrayRankMismatch

[kosmosec]

Run .exe from memory returns 0x80131538 code (https://github.com/marcussacana/RemoteControl/blob/master/RemoteControl/HResults.cs).
[+] Loaded CLR into this process [+] Got default AppDomain [+] Loaded 3584 bytes into memory from TestExe.exe [+] Crated SafeArray from byte array 2021/03/08 18:30:57 appDomain.Load_3 returned 0x80131538

I've also used your C# code from your blog post and it is also causes error.

The quick fix for this is:
hr = appDomain.Load_3(uintptr(unsafe.Pointer(safeArray)), &rawAssemblyAddr)
instead of
hr = appDomain.Load_3(uintptr(unsafe.Pointer(&safeArray)), &rawAssemblyAddr)

[naweka]

Thanks!