Alternatives to JitHooking

[noob.exe]

Yo,

I am planning to code some method encryption, and I wanted to ask if there are alternatives to JitHooking.

The problem is not hoe to encrypt/decrypt the methodbodys, - that's simple, the question is how I can detect the calls so I know when to decrypt.

JitHooking is pretty unstable and might not work properly in future versions of the .Net FW.

I am open for ideas and suggestions.

[XenocodeRCE]

You can use Invoke and Pointer, if, for instance, you store your encrypted method in a specific Header

[0xd4d]

You can create a DynamicMethod. It has its limitations but should work with most methods. Used by some obfuscators.

[noob.exe]

You can create a DynamicMethod. It has its limitations but should work with most methods. Used by some obfuscators.

Yo,

I've heared of dynamic methods before but I don't entirely get the concept behind.

For example, I encrypt the methodbody of some testmethod.

Alright.

I can also insert some decryption method somewhere, also not a problem.

But how would you detect the calls to the original method so the decryption will be triggered?

Could you give me some more detailed explanation please, that would be nice

(Yes I know the msdn articles about dynamic methods)

[li0nsar3c00l]

just replace every methodbody with the call to a dynamic method which uses the original method body.