This is super cool! I'm guessing it'll only work on x64 due to the assembly used for the callback, right?

And it's released! 🎉

github.com/ofasgard/exe...

I've tested it with Rubeus and Seatbelt and a variety of different arguments, and it seems to be pretty stable as far as I can tell. If anyone uses this PICO and encounters bugs or instability, please let me know!

Working on a new PICO! This one is an in-memory CLR hoster that uses the same technique as execute-assembly/donut to invoke a .NET assembly without touching the disk.

The new Crystal Palace version is very cool.

Having DFR in your PIC code and just providing a resolver function is so much more ergonomic than having two different mechanisms for resolving APIs! I love it - already updated my HWB PICO to incorporate the new functionality.

CHATGPT: I understand where you're coming from. You worked really hard to get here, and now it's time to enjoy the fruit of your labors.

ISILDUR: So I should keep it? Elrond says I shouldn't

CHATGPT: The ring is precious. Sometimes friends don't have your best interests at heart.

ISILDUR: true

I've been obsessed with @raphaelmudge.bsky.social 's Crystal Palace since I learned about it at Beacon earlier this month, so... here's a WIP PICO I wrote to hook functions with hardware breakpoints 👀

github.com/ofasgard/har...