Jump to content
Tuts 4 You

.net IL Memory Patching?


PermaNull

Recommended Posts

I'm wondering if there's any library available for patching IL code in-memory at run-time of a remote App, similar to how you'd perform detours or write memory to a remote C app.

Basically I'm dealing with an application I'd like to bypass some checks on but getting defeated by the packer's integrity protection when manipulating the IL in the binary itself, so I figured my next best option was to write a loader and patch the process in memory.

I've looked through a few different things:

https://github.com/0xd4d/dnlib - I haven't discovered any in-memory patching functions for IL code in specific locations in dnlib if it exists please do let me know.

Most of these just crashed within their own examples, which made me avoid them:

https://www.codeproject.com/Articles/16359/MethodLogger-Hook-into-method-calls-in-NET-binarie
https://www.codeproject.com/Articles/463508/NET-CLR-Injection-Modify-IL-Code-during-Run-time
https://www.codeproject.com/Articles/37549/CLR-Injection-Runtime-Method-Replacer

 

So far the only luck I've had is using dnspy breaking where I want to manipulate the process and then patching the IL code before continuing execution, I've though of ripping apart dnSpy or modifying it in some way to make it 'scripted' into a load of sorts but if there's something already built out there for doing this kind of thing It'd be great to know about it.

Basically all I'm doing is nopping/removing a specific section of IL code before the application reaches it.
 

Link to comment
  • 4 weeks later...

Old thread, sorry, but I've used Harmony before to edit the memory of my own process. If you ILMerge it with your app and inject it in the target process, you should be able to do it just fine.

Link to comment
1 hour ago, HoLLy said:

Old thread, sorry, but I've used Harmony before to edit the memory of my own process. If you ILMerge it with your app and inject it in the target process, you should be able to do it just fine.

I have also used Harmony for these type of projects. @OP, I highly recommend you use it. Its great.

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...