1

I'm trying to make some changes to .Net dll (note: dll is mixed mode module) used by an exe, ProtectionID detected nothing, so I happily jumped into dnSpy and made changes.

I ran executable with dnSpy debugger and everything was working as expected. However when I saved module and tried to run executable, it worked as if no changes were made.

I double checked, but module saved correctly, and x64dbg shows that it is loaded on runtime. So how is this possible?

5
  • are you sure your changes were actually saved? compare the saved file against the original
    – Igor Skochinsky
    Aug 18, 2017 at 18:54
  • yeah, changes were saved, saved file is also ~30% bigger, but so far all files I saved with dnSpy were 10-30% bigger. I even opened modified dll in Reflector instead, changes are there. they just don't seem to affect execution if I don't use dnSpy debugger. Aug 18, 2017 at 19:36
  • 1
    I think we need a bit more info. What arę the changes you've made? Are they for sure executed always? Are you sure that the dll is loaded from where you put the new one - check ProcessMonitor log. Aug 19, 2017 at 6:35
  • @PawełŁukasik Huh I think I found a reason, it appears to use native images. I'm not sure if I can generate modified native image without source, especially if it's mixed-mode module. Aug 19, 2017 at 12:48
  • Did you check the GAC?
    – mrexodia
    Aug 20, 2017 at 9:58

1 Answer 1

0

Found the reason and I feel quite retarded now since it was so obvious. It was NativeImage being loaded and removing all generated images actually made my changes load. Thanks @PawełŁukasik for pointing me in right direction.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.