kbeandClaude Opus 4.8
4405af15fd
Design-only foundation for WhiteMagic, a .NET 8 x64 library unifying the four studied process-manipulation libs. Adds proposal, design (7 decisions), 7 capability specs, and TDD task breakdown; all validate strict. Move Blackmagic, Blackmagic-old, GreyMagic, MemorySharp, fasm into reference/ (gitignored) — studied, not built here; each has its own upstream repo and nested .git. Rewrite plan doc paths to reference/. Corrects two factual defects found in review: - current BlackMagic has no D3D EndScene hook; MainThreadPump is net-new built on DetourManager, not a port - no BlackMagic.slnx exists; task 1.3 creates a fresh solution Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1.6 KiB
1.6 KiB
Why
BlackMagic replaced FASM for shellcode generation but lost two useful capabilities:
-
Non-blocking remote execution (
InjectAndExecuteEx): FASM's managed wrapper returned a thread handle without waiting. BlackMagic only has blockingExecute(). For DLL injection, a non-blocking variant avoids hanging when the target is slow to load. -
Text-based assembly: FASM allowed building shellcode from assembly text (
AddLine("pushad")). BlackMagic requires hand-assembledbyte[]. For prototyping, debugging, and one-off shellcode, text assembly is faster to write and easier to review. A managed assembler eliminates the native FASM DLL dependency while keeping the ergonomic benefit.
What Changes
- Add
InjectAndExecuteEx()toBlackMagicandBMThread: inject code then create a remote thread without waiting, returning the thread handle. - Add
AsmBuilderclass: pure C# x86 text assembler that converts instruction text tobyte[]machine code. Supports common shellcode instructions (mov, push, pop, call, jmp, ret, nop, pushad/popad, test, je, jne, inc, add, sub, xor, etc.). - Add
InjectAndExecute(string asm)andInjectAndExecuteEx(string asm)overloads that accept assembly text, assemble viaAsmBuilder, then inject+execute. - Add
SetPassLimit()toAsmBuilderfor label resolution iteration control.
Capabilities
New Capabilities
non-blocking-execute: Non-blocking remote thread creation that returns a handle without waiting for exit.text-assembler: Pure C# x86 text assembler converting assembly source to byte arrays without native dependencies.