+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] Hooking .net function calls (/showthread.php?tid=5739133)
Hooking .net function calls - BahNahNah - Oct 17, 2017
The goal here is to be able to hook/redirect calls from .net code on runtime.
An example scenario is injecting a managed dll into a unity game and hooking the unity OnGui function to your newly injected library.
Hooking the jit method table (e.g.) is a possibility but i have found this kinda unreliable and would rather do it in a lower level style by hooking the .net framework/jit more directly.
The two options i have thought of is
1) Hooking the jit compiler. (like ubbe's project) and redirecting while it is being compiled
However, this would require reversing the jit compile on any method that i wish to hook that is alredy been jit-compiled. Wich is a likely senario.
I couldn't find any info on un-jit-compiling methods.
2) Hooking the low-level .net calling procedures.
I really dont know anything about this. I have looked around for any starting place on this but came out empty handed.
Any help on either of these solutions, or any new solutions would be greatly appreciated.
* - HFDone - Oct 18, 2017
https://en.wikipedia.org/wiki/List_of_CIL_instructions
like native api hook you can hook net method by using the bytescode to do it
and its much simple then ubbe way
* - Washi - Oct 18, 2017
(Oct 18, 2017 02:00 AM)HFDone Wrote: https://en.wikipedia.org/wiki/List_of_CIL_instructions
like native api hook you can hook net method by using the bytescode to do it
and its much simple then ubbe way
That would require you to either patch the program on the disk, or use a jit hook anyway and somehow make that the method you're hooking is not jitted yet. since the IL code is only interpreted once by the runtime and then translated into native code.
@op: I was thinking (and not sure if it would actually work), you could maybe use the Marshal.GetFunctionPointerForDelegate to get the native function pointer to a method of your choice. You could then follow that pointer and edit the first few assembly instructions that will call or jump to your callback function, thus installing a hook. You could also have a look at hooking libraries (maybe easyhook), feed in this function pointer and let them do the work for you.
* - HFDone - Oct 18, 2017
(Oct 18, 2017 02:16 AM)Washi Wrote: That would require you to either patch the program on the disk, or use a jit hook anyway and somehow make that the method you're hooking is not jitted yet. since the IL code is only interpreted once by the runtime and then translated into native code.
@op: I was thinking (and not sure if it would actually work), you could maybe use the Marshal.GetFunctionPointerForDelegate to get the native function pointer to a method of your choice. You could then follow that pointer and edit the first few assembly instructions that will call or jump to your callback function, thus installing a hook. You could also have a look at hooking libraries (maybe easyhook), feed in this function pointer and let them do the work for you.
what you offer to op thats what i mean and already done 😉
* - ForceJew - Oct 18, 2017
You can just change the OnGui in dnspy
* - BahNahNah - Oct 18, 2017
(Oct 18, 2017 02:16 AM)Washi Wrote: @op: I was thinking (and not sure if it would actually work), you could maybe use the Marshal.GetFunctionPointerForDelegate to get the native function pointer to a method of your choice. You could then follow that pointer and edit the first few assembly instructions that will call or jump to your callback function, thus installing a hook. You could also have a look at hooking libraries (maybe easyhook), feed in this function pointer and let them do the work for you.
This might work. I'll do so.e research on jitted methods and seekf I can dig anything up.
(Oct 18, 2017 11:05 AM)ForceJew Wrote: You can just change the OnGui in dnspy
That is not the goal.
OnGui hook was just an example.
* - 3dsboy08 - Oct 18, 2017
https://github.com/pardeike/Harmony
Thank me later. Works quite well, the Transcompiler is really useful.
* - stefsot - Oct 18, 2017
option one is not possible as Unity games are using mono
second option is the best imo
I would share how to do it but I'm using it on my own projects.
RE: Hooking .net function calls - melk - Dec 18, 2019
can you pm me please need help with something
(Oct 18, 2017 02:24 PM)3dsboy08 Wrote: https://github.com/pardeike/Harmony
Thank me later. Works quite well, the Transcompiler is really useful.
can you pm me please need help with something thanks