Skip to content
YSoNet

DataTable

gadget

Same-graph System.Data.DataTable root carrier: the inner TextFormattingRunProperties gadget travels in an object column and is deserialized by the same outer formatter. A standalone DataTable stores its rows inline in its own SerializationInfo (DataTable_N.Records), so unlike the DataSet gadget it opens no nested BinaryFormatter and no new binder boundary (verified against the System.Data source). Useful when a target requires or casts the deserialized root object to DataTable, for example SharePoint's ExcelDataSet.CompressedDataTable. Microsoft treats deserializing a DataTable with an unsafe formatter as a full remote code execution risk (CA2362, DataSet/DataTable security guidance). The inner gadget is selectable with var/variant: 1 (default) TextFormattingRunProperties, which needs the Microsoft.PowerShell.Editor assembly and WPF and supports BinaryFormatter, SoapFormatter and LosFormatter; 2 TypeConfuseDelegate, a framework built-in that needs no WPF or Microsoft.PowerShell.Editor and supports BinaryFormatter, SoapFormatter and LosFormatter. Its SOAP form uses generation-only aliases but presents the native CLR4 TCD graph to the target. Forshaw's 'Are You My Type?' (Black Hat 2012) documents the related but distinct DataSet nested-BinaryFormatter bridge.

Declared metadata, not a runtime result. How to read evidence.

Terminal window
.\ysonet.exe -g DataTable -h

Target declarations

VariantFormattersInputsRequirementsRuntime tokens
1BinaryFormatter, SoapFormatter, LosFormattercommandextra-assembly, wpf, net-frameworknet-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1
2BinaryFormatter, SoapFormatter, LosFormattercommandbuilt-in, net-frameworknet-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1
Variants
  • 1: TextFormattingRunProperties inner (default) (default)
  • 2: TypeConfuseDelegate inner (built-in, no WPF)
Options (1)
OptionHelpDefaultRequired
var|variant=Inner gadget: 1 -> TextFormattingRunProperties [default], 2 -> TypeConfuseDelegate (built-in, no WPF) Default value: "1". Suggested values: 1, 2.1false

Credit: [Finders: Soroush Dalili]

All modules · Full catalog JSON