RTO 75c6c241e6 QoL update		%!s(int64=2) %!d(string=hai) anos
..
README.md	75c6c241e6 QoL update	%!s(int64=2) %!d(string=hai) anos
beacon.h	75c6c241e6 QoL update	%!s(int64=2) %!d(string=hai) anos
bofcompile.bat	75c6c241e6 QoL update	%!s(int64=2) %!d(string=hai) anos
enumdotnet.c	75c6c241e6 QoL update	%!s(int64=2) %!d(string=hai) anos
enumdotnet.cna	75c6c241e6 QoL update	%!s(int64=2) %!d(string=hai) anos
enumdotnet.h	75c6c241e6 QoL update	%!s(int64=2) %!d(string=hai) anos
enumdotnet.o	75c6c241e6 QoL update	%!s(int64=2) %!d(string=hai) anos

EnumDotnet

Enumerate processes that most likely have .NET loaded by searching for the section name: \BaseNamedObjects\Cor_Private_IPCBlock(_v4)_<ProcessId>

Usage

enumdotnet

Compile

1. Make sure Visual Studio is installed and supports C/C++.
2. Open the x64 Native Tools Command Prompt for VS <2019/2022> terminal.
3. Run the bofcompile.bat script to compile the object file.
4. In Cobalt strike, use the script manager to load the .cna script to import the tool.