DOSReplace.cs

using System;
using System.Reflection;
using System.Runtime.InteropServices;

namespace AntiDumpExample
{
    unsafe static class DOSReplace
    {
        [DllImport("kernel32.dll", SetLastError = true)]
        private static extern bool VirtualProtect(void* lpAddress, uint dwSize,
            uint flNewProtect, out uint lpflOldProtect);

        static void NotMain()
        {
            //Get base address of the module in memory
            byte* ptr = (byte*)Marshal.GetHINSTANCE(typeof(DOSReplace).Module);

            uint size = 0x40; // Decimal 60 as hex equal to the size of the DOS Header#

            // Change protection of DOS Header in memory to 0x04 = PAGE_READWRITE
            VirtualProtect(ptr, size, 0x04, out uint oldProtect);

            // Fake ZIP Header
            byte[] zipHeader =
            {
                0x50, 0x4B, 0x2E, 0x2E, 0x1A, 0x07, 0x01, 0x00, 0x68, 0x30, 0xE1, 0xEF, 0x10, 0x01, 0x05, 0x0C, 0x14, 0x0B, 0x01, 0x01,
                0xD6, 0xE8, 0xF7, 0xF9, 0x86, 0x80, 0x80, 0x80, 0x00, 0x9E, 0x2C, 0xD5, 0x01, 0x58, 0x02, 0x03, 0x0B, 0xD8, 0x01, 0x04,
                0xA5, 0x01, 0x80, 0x01, 0x87, 0x10, 0x17, 0xDA, 0x80, 0x45, 0x00, 0x3B, 0x45, 0x78, 0x61, 0x6D, 0x70, 0x6C, 0x65, 0x7A
            };

            // Overwrite bytes of DOS Header in memory with the bytes from zipHeader
            for (int i = 0; i < zipHeader.Length; i++)
                *((byte*)ptr + i) = zipHeader[i];

            // Modifying SizeOfOptionalHeader, only works properly on x64
            // Check the write up for further information
            if (IntPtr.Size == 8)
            {
                ptr += *(uint*)(ptr + 0x3C);
                // Set SizeOfOptionalHeader to ushort.MaxValue
                *(ushort*)(ptr + 0x14) = ushort.MaxValue;
            }


            Console.WriteLine("Replaced DOS Header with ZIP Header");

            // Restore protection to original protection saved in oldProtect
            VirtualProtect(ptr, size, oldProtect, out _);
        }
    }
}