1

What I am trying to do:

I have an .exe written in C#. Ilspy shows the code. Inside it has a class DoWork with static field SomeValue:

// Program.DoWork
public static int SomeValue => 15;

In code, however, it's not a field but a getter function:

// return 15;
IL_0000: ldc.i4.s 15
IL_0002: ret

and I want to modify this function to return 127 instead. I've found the location of the function inside .exe binary dump:

0x123456  1f 0f 2a

I've modified .exe in HxD editor so new binary dump has this:

0x123456  1f 7f 2a

When I open modified .exe with Ilspy it shows:

// Program.DoWork
public static int SomeValue => 127;

So all seems well, but it doesn't work. The modified .exe still runs as if SomeValue is 15.

Questions:

  1. Is this a valid approach to modifying .net assembly?
  2. If yes, what am I missing?
7
  • yes, this should work, for the missing part hard to say, w/o looking into the binary Nov 24 at 12:54
  • @PawełŁukasik is IL translated every time exe is run, can it be that x86 representation is cached somewhere?
    – Uprooted
    Nov 24 at 12:57
  • unless it's ngen-ed it is compiled every time you run it Nov 24 at 13:00
  • It probably is, how do I check this?
    – Uprooted
    Nov 24 at 13:05
  • ngen display will list all of the ngen'ed assemblies installed on the system Nov 24 at 13:38
1

Turned out the executable is a ReadyToRun executable, so it contains both IL and prebuilt x86-64 image. Modifying IL wasn't working because only x86 image was used at runtime. Modifying x86 image worked for me. ILSpy is capable of showing ReadyToRun image alongside C# and IL.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.