Skip to main content
5 of 5
deleted 2 characters in body

Patch .net executable via hex editor

What I am trying to do:

I have an .exe written in C#. Ilspy shows the code. Inside it has a class DoWork with static field SomeValue:

// Program.DoWork
public static int SomeValue => 15;

In code, however, it's not a field but a getter function:

// return 15;
IL_0000: ldc.i4.s 15
IL_0002: ret

and I want to modify this function to return 127 instead. I've found the location of the function inside .exe binary dump:

0x123456  1f 0f 2a

I've modified .exe in HxD editor so new binary dump has this:

0x123456  1f 7f 2a

When I open modified .exe with Ilspy it shows:

// Program.DoWork
public static int SomeValue => 127;

So all seems well, but it doesn't work. The modified .exe still runs as if SomeValue is 15.

Questions:

  1. Is this a valid approach to modifying .net assembly?
  2. If yes, what am I missing?