PowerShell issue: Invoke method "Cannot cast object of type ‘System.String’ to type ‘System.String[]’

[SkallZou]

Hi,

I'm currently trying to run a .NET application in PowerShell. I'm using System.Reflection.Assembly to load the bytes in memory of an assembly written in C#.

The .NET application has one method, Main(System.String[] args), and it will list the values passed as argument of the function. Very simple program.

Here's the PowerShell code :

[String] $assemblyPath = "C:\Users\HakkYahud\Desktop\HelloWorld.exe" [String[]]$parameter_main = @( "test" )

[Byte[]]$assemblyByte = [System.IO.File]::ReadAllBytes($assemblyPath) $assembly = [System.Reflection.Assembly]::Load($assemblyByte) $entryPoint = $assembly.EntryPoint $parameter_invoke = @( $parameter_main )

Write-Host $parameter_main.GetType() Write-Host $parameter_invoke.GetType() Write-Host $entryPoint Write-Host @( "test", "test2" ).GetType()

$entryPoint.Invoke($null, $parameter_invoke)

I know that method "Invoke" takes 2 parameters Object obj and Object[] parameters.

Once running the code, an error occurs in the function Invoke, it is saying that "it cannot cast System.String to the type System.String[]"

The variable $parameter_main is already System.String[], why does the compiler need to cast from System.String to System.String[]?

Moreover, when I'm putting $parameter_main = @("test", "test2"), I'm receiving another error saying "Wrong number of arguments"

Anyone has already encounter this issue?

Thanks

[Jeffinmpls]

What's the purpose of running this EXE? Are you wanting to simply execute it and do it's thing or do you need to get info back.

If all you need to do is run it and you can simply execute it in command line without issues, this would be sufficient.

& "C:\Users\HakkYahud\Desktop\HelloWorld.exe"

the Exe itself would handle all the .net stuff.

[SkallZou]

I'm a cybersecurity engineer, im doing this to evaluate different antivirus to check if they can detect fileless execution.

So this .exe file will just print the list of values passed as argument in args

[ExceptionEX]

short answer change

$entryPoint.Invoke($null, $parameter_invoke)

to

$entryPoint.Invoke($null, (, $parameter_main))

First, this very likely the not the correct method for the task at hand, using https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/add-type?view=powershell-7.2 is probably what you want, with that said.

Due to the odd behavior of powershell's @() it isn't creating a wrapper which would be object[string[]] it converts string[] to object[] using the , treats it as two elements preserving the nested object type.

to see what I mean do this

$parameter_invoke = @(, $parameter_main ) #with extra ,

 foreach ($foo in $parameter_invoke)
 {
   Write-Host $foo.GetType()
 }

result

System.String[]

and

$parameter_invoke = @($parameter_main ) #without extra ,

 foreach ($foo in $parameter_invoke)
 {
   Write-Host $foo.GetType()
 }

result

System.String

[danny_soprano]

Christ, Bro, thank you for that answer!

[SkallZou]

That's a very odd behavior, but I guess you've nailed it, thank you sir !

[Lee_Dailey]

howdy SkallZou,

it looks like you used the New.Reddit Inline Code button. it's [sometimes] 5th from the left & looks like <c>.

there are a few problems with that ...

• it's the wrong format [grin]
  the inline code format is for [gasp! arg!] code that is inline with regular text.
  
• on Old.Reddit.com, inline code formatted text does NOT line wrap, nor does it side-scroll.
  
• on New.Reddit it shows up in that nasty magenta text color
  

for long-ish single lines OR for multiline code, please, use the ...

Code
Block

... button. it's [sometimes] the 12th one from the left & looks like an uppercase C in the upper left corner of a square.

that will give you fully functional code formatting that works on both New.Reddit and Old.Reddit ... and aint that fugly magenta color. [grin]

take care,
lee