I'm trying to make some changes to .Net dll (note: dll is mixed mode module) used by an exe, ProtectionID detected nothing, so I happily jumped into dnSpy and made changes.

I ran executable with dnSpy debugger and everything was working as expected. However when I saved module and tried to run executable, it worked as if no changes were made.

I double checked, but module saved correctly, and x64dbg shows that it is loaded on runtime. So how is this possible?

  • are you sure your changes were actually saved? compare the saved file against the original – Igor Skochinsky Aug 18 '17 at 18:54
  • yeah, changes were saved, saved file is also ~30% bigger, but so far all files I saved with dnSpy were 10-30% bigger. I even opened modified dll in Reflector instead, changes are there. they just don't seem to affect execution if I don't use dnSpy debugger. – K. Kowalczyk Aug 18 '17 at 19:36
  • 1
    I think we need a bit more info. What arę the changes you've made? Are they for sure executed always? Are you sure that the dll is loaded from where you put the new one - check ProcessMonitor log. – Paweł Łukasik Aug 19 '17 at 6:35
  • @PawełŁukasik Huh I think I found a reason, it appears to use native images. I'm not sure if I can generate modified native image without source, especially if it's mixed-mode module. – K. Kowalczyk Aug 19 '17 at 12:48
  • Did you check the GAC? – mrexodia Aug 20 '17 at 9:58

Found the reason and I feel quite retarded now since it was so obvious. It was NativeImage being loaded and removing all generated images actually made my changes load. Thanks @PawełŁukasik for pointing me in right direction.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.