+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] How to dynamically get c# API functions? (/showthread.php?tid=6128496)
How to dynamically get c# API functions? - Tr0jandog - Dec 20, 2020
Hello yall
so as you you all know, in C we can simply use loadlibrary+getprocaddr to get the address, or even parse the TEB/PEB to find the addresses without even using a single API
but, how to do it for C# APIs?
for example, in my crypter i am using these APIs :
Assembly.GetExecutingAssembly()
ResourceManager()
CreateDecryptor()
CryptoStream()
..
now these are often could lead to detection, how can i find them and use them just like in C, without directly using them?
note that I'm asking about .NET APIs, I'm not looking for a way to call kernel32/ntdll APIs in c# as I already know how.
any open source project that demonstrates this in c#?
RE: How to dynamically get c# API functions? - riu41776 - Dec 20, 2020
lol just dllimport LoadLibrary and GetProcAddress.
Ok, so you're talking about a managed code dll, i know how to do it statically by referencing the dll/class but dynamically you can use Relfection.
RE: How to dynamically get c# API functions? - HFDone - Dec 20, 2020
same as in C use APIs
search the section for dynamic api call
RE: How to dynamically get c# API functions? - Tr0jandog - Dec 20, 2020
(Dec 20, 2020 06:39 AM)riu41776 Wrote: lol just dllimport LoadLibrary and GetProcAddress.
Ok, so you're talking about a managed code dll, i know how to do it statically by referencing the dll/class but dynamically you can use Relfection.
(Dec 20, 2020 06:41 AM)HFDone Wrote: same as in C use APIs
search the section for dynamic api call
But as i said i want to call .NET apis like Assembly.GetExecutingAssembly(), i dont want to call functions inside ntdll/kernel32
which dll should i import using dllimport/loadlibrary and which function inside of it should i call to dynamically call GetExecutingAssembly?
as far as i know .NET executables only import mscoree.dll with only CorExeMain function
There has to be some structure like PEB in .net executables that i can use to find .net APIs and call them directly
i know that library calls in .NET are in a way that they reference an index inside a table, but not sure how can i use this to call the API in runtime
RE: How to dynamically get c# API functions? - HFDone - Dec 20, 2020
Load the Dll Assembly.Load (or Assembly.LoadFrom)
Call Assembly.GetTypes for each type call Type.GetMethods to get the Method
Get MethodInfo and call MethodInfo.Invoke
RE: How to dynamically get c# API functions? - TITANIUM_DZ - Jan 16, 2021
you can use Method CallByName From reference Microsoft.VisualBasic
Interaction.CallByName(
AppDomain.CurrentDomain,
"Load",
CallType.Method,
Convert.FromBase64String("base64")
);
RE: How to dynamically get c# API functions? - gigajew - Jan 17, 2021
https://github.com/gigajew/CallByString for regular .NET stuff. Stay tuned to the git.
RE: How to dynamically get c# API functions? - SIM-4717218 - Jan 18, 2021
look at http://pinvoke.net/