1

I have a managed .NET executable that supplies the msil bytecode of a function as raw bytes. It constructs a DynamicMethod object, sets the bytecode with DynamicMethod.DynamicILInfo.SetCode() and invokes it with DynamicMetho.Invoke().

What is the best way to decompile or step into this DynamicMethod thing? How do I reverse it?

DnSyp doc has this to say:

Dynamic modules can be debugged (but not dynamic methods due to CLR limitations)

But there has to be a way to deal with it.

I am new to .NET debugging so there might be a simple solution I am missing.

2
  • Flare-On chall 8? ;) Oct 13, 2022 at 17:57
  • yes. .NET is entirely beyond me. i have literally opened dnspy for the first time yesterday. Oct 13, 2022 at 18:58

1 Answer 1

3

You can debug DynamicMethod's using the EventPipe API. I've written a library that uses it to allow for code injection via DynamicMethod that can be debugged: https://github.com/damieng/DamienG.Library/blob/master/DamienG.Library/Diagnostics/EventPipe/DynamicMethodInjector.cs

First, create a new DynamicMethodInjector object: var injector = new DynamicMethodInjector("MyTypeName", "MyMethodName");

Then, add some IL to your DynamicMethod: injector.AddMethodBody(ILGenerator il);

You can then invoke the DynamicMethod as normal, adding a breakpoint to the EventPipe.Start method to avoid hitting the breakpoint before the IL is injected: // Inject IL into the process injector.Inject();

// Invoke your DynamicMethod var result = (int)m.Invoke(obj, new object[] { 1, 2 });

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.