Using x64dbg to reverse-confuse unmanaged shells

Systemdomain::executemainmethod the breakpoint, is a very eclectic solution, not too deep inside the CLR, will not casually be caught
When you run here, the main assembly has been restored to the corresponding location by these unmanaged shells
Why does this say, see

This is the call stack for the main thread (I ran the message pump in the main thread, so I paused)
You can see that the bottom is an unnamed address and it should be a shell like TMD.
Look up, there's a clr._corexemain and Clr._corexemaininternal,clr._corexemain is an export function

There is the risk of being hook, so the breakpoint here is not suitable, clr._corexemaininternal can actually, but not very good (not tested)
Then the
······
Clr. Runmain
Clr. Assembly::executemainmethod
Clr. Systemdomain::executemainmethod
Clr. Executeexe
······
These 4 should all be possible, are relatively safe, almost impossible to hook, direct dump at this time the main module is no problem
However, only the CLR was tested. Systemdomain::executemainmethod, tested 3 shells (2 strong shells, 1 packers), all available

Using x64dbg to reverse-confuse unmanaged shells