3

Are there techniques for patching .net executables in memory? Let's say we've have a .net dll/exe, we identified what method we want to patch and what IL to replace the existing code with. Executing this on the binary file is easy (let's assume it does not have a strong name for simplicity). But what if we want to leave the file intact? Is it possible to make the patch in-memory? Maybe it is possible to write an exe loader that would intercept dll loading and re-write IL on the fly somehow?

The problem is that once the code is in memory it is no longer IL, but natively compiled, and thus, our knowledge of what method we want to patch with which IL does not help us a lot. So it looks like doing this during load time is the only way which might allow us not modifying the original files on disk. Is this possible?

Note: I'm especially interested in the case where the main program executable is not .net, but native, which loads .net dlls, such as in case with Unity3D player.

4

Low-level details and implementation for patching and intercepting .NET code at runtime: http://www.ntcore.com/files/netint_injection.htm

High-level details and implementation for patching and intercepting .NET code at runtime: http://www.codeproject.com/Articles/16359/MethodLogger-Hook-into-method-calls-in-NET-binarie

  • Thank you. very good info, chances are it will solve this for me. I'll let other people chime in if they want and I'll accept an answer in a few days. – Andrew Savinykh Oct 8 '15 at 0:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.