I have a .NET exe that creates DynamicMethods whose bodies are built from a byte array and later called. I'm able to access the array, and even to disassemble it "raw" starting from the bytes to get an idea of what the method is doing but i'm unable to dump these methods to disk in a reliable way. I've tried with dnSpy by copying the resulting IL instructions, however i need to do this for something like 70 functions, some of them over 3000 bytes long and i'm trying to automate it. The problem i have is that an instruction like this
IL_0002: newobj Void .ctor(System.Exception)/System.Diagnostics.StackTrace
corresponds to:
raw bytes : 02 73 02 00 00 06
IL_0002 newobj 0x06000002
However, the way it's stored on disk becomes:
raw bytes : 02 73 E5 00 00 0A
IL_0002 newobj 0x0A0000E5
I've read the ECMA specification for CIL but i haven't found how these tokens are translated or what offsets are used in this particular computation.
TLDR What i'm trying to do is to restore the bodies of methods of an executable that have been replaced with random junk from their byte representation in an automated way, ideally by rewriting the section that's supposed to contain the instructions. I hope it's not too similar to another question regarding .NET (and the same challenge i believe) that's still open.
similar question, i believe my problem is different though.
