DataTableTypeSpoof
gadget
The DataTable carrier written under the name of a REAL DataTable subclass, so a target that rejects System.Data.DataTable by name still rebuilds it through the inherited serialization constructor; this is not the ', x=]' binder-parse trick DataSetTypeSpoof uses, and it is the same idea watchTowr used on DataSet subclasses for CVE-2025-23120. Default profile: the in-box System.Data.Entity.Design.SsdlGenerator.TableDetailsCollection (assembly System.Data.Entity.Design, part of the full .NET Framework); --target-type and --target-assembly write any name verbatim, for the second in-box profile RelationshipDetailsCollection or a subclass from the target's own assemblies.
Declared metadata, not a runtime result. How to read evidence.
.\ysonet.exe -g DataTableTypeSpoof -hTarget declarations
| Variant | Formatters | Inputs | Requirements | Runtime tokens |
|---|---|---|---|---|
| 1 | BinaryFormatter, SoapFormatter, LosFormatter | command | extra-assembly, wpf, net-framework | net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
| 2 | BinaryFormatter, SoapFormatter, LosFormatter | command | built-in, net-framework | net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
Variants
- 1: TextFormattingRunProperties inner (default) (default)
- 2: TypeConfuseDelegate inner (built-in, no WPF)
Options (3)
| Option | Help | Default | Required |
|---|---|---|---|
var|variant= | Inner gadget: 1 -> TextFormattingRunProperties [default], 2 -> TypeConfuseDelegate (built-in, no WPF) Default value: "1". Suggested values: 1, 2. | 1 | false |
target-type= | Type name written on the wire, verbatim. Must be a DataTable subclass on the TARGET. Default: "System.Data.Entity.Design.SsdlGenerator.TableDetailsCollection". Second in-box profile: System.Data.Entity.Design.SsdlGenerator.RelationshipDetailsCollection Default value: "System.Data.Entity.Design.SsdlGenerator.TableDetailsCollection". | System.Data.Entity.Design.SsdlGenerator.TableDetailsCollection | false |
target-assembly= | Assembly identity written on the wire, verbatim (Name, Version=..., Culture=..., PublicKeyToken=...). Default: "System.Data.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Default value: "System.Data.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089". | System.Data.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 | false |
Credit: [Finders: Soroush Dalili]