Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact

.NET 

Hooking .net function calls

The goal here is to be able to hook/redirect calls from .net code on runtime.

An example scenario is injecting a managed dll into a unity game and hooking the unity OnGui function to your newly injected library.

Hooking the jit method table (e.g.) is a possibility but i have found this kinda unreliable and would rather do it in a lower level style by hooking the .net framework/jit more directly.

The two options i have thought of is

1) Hooking the jit compiler. (like ubbe's project) and redirecting while it is being compiled
However, this would require reversing the jit compile on any method that i wish to hook that is alredy been jit-compiled. Wich is a likely senario.
I couldn't find any info on un-jit-compiling methods.


2) Hooking the low-level .net calling procedures.
I really dont know anything about this. I have looked around for any starting place on this but came out empty handed.

Any help on either of these solutions, or any new solutions would be greatly appreciated.
Lotta blood to let, peace to make, give a fuk about a check
https://en.wikipedia.org/wiki/List_of_CIL_instructions
like native api hook you can hook net method by using the bytescode to do it
and its much simple then ubbe way
[Image: bitcoin.png] Be Nice For Once 15hVUVz7xA4kazHdk2BuErENGCskVwjYXP
(Oct 18, 2017 02:00 AM)HFDone Wrote:  https://en.wikipedia.org/wiki/List_of_CIL_instructions
like native api hook you can hook net method by using the bytescode to do it
and its much simple then ubbe way

That would require you to either patch the program on the disk, or use a jit hook anyway and somehow make that the method you're hooking is not jitted yet. since the IL code is only interpreted once by the runtime and then translated into native code.

@op: I was thinking (and not sure if it would actually work), you could maybe use the Marshal.GetFunctionPointerForDelegate to get the native function pointer to a method of your choice. You could then follow that pointer and edit the first few assembly instructions that will call or jump to your callback function, thus installing a hook. You could also have a look at hooking libraries (maybe easyhook), feed in this function pointer and let them do the work for you.
https://github.com/Washi1337

"I'll tell you this UDP joke, and I don't care if you will get it or not."
(Oct 18, 2017 02:16 AM)Washi Wrote:  That would require you to either patch the program on the disk, or use a jit hook anyway and somehow make that the method you're hooking is not jitted yet. since the IL code is only interpreted once by the runtime and then translated into native code.

@op: I was thinking (and not sure if it would actually work), you could maybe use the Marshal.GetFunctionPointerForDelegate to get the native function pointer to a method of your choice. You could then follow that pointer and edit the first few assembly instructions that will call or jump to your callback function, thus installing a hook. You could also have a look at hooking libraries (maybe easyhook), feed in this function pointer and let them do the work for you.

what you offer to op thats what i mean and already done 😉
[Image: bitcoin.png] Be Nice For Once 15hVUVz7xA4kazHdk2BuErENGCskVwjYXP
You can just change the OnGui in dnspy
(Oct 18, 2017 02:16 AM)Washi Wrote:  @op: I was thinking (and not sure if it would actually work), you could maybe use the Marshal.GetFunctionPointerForDelegate to get the native function pointer to a method of your choice. You could then follow that pointer and edit the first few assembly instructions that will call or jump to your callback function, thus installing a hook. You could also have a look at hooking libraries (maybe easyhook), feed in this function pointer and let them do the work for you.

This might work. I'll do so.e research on jitted methods and seekf I can dig anything up.

(Oct 18, 2017 11:05 AM)ForceJew Wrote:  You can just change the OnGui in dnspy

That is not the goal.
OnGui hook was just an example.
Lotta blood to let, peace to make, give a fuk about a check
https://github.com/pardeike/Harmony

Thank me later. Works quite well, the Transcompiler is really useful.
option one is not possible as Unity games are using mono
second option is the best imo

I would share how to do it but I'm using it on my own projects.
can you pm me please need help with something


(Oct 18, 2017 02:24 PM)3dsboy08 Wrote:  https://github.com/pardeike/Harmony

Thank me later. Works quite well, the Transcompiler is really useful.

can you pm me please need help with something thanks


Possibly Related Threads...
Thread / Author Replies Views Last Post
[C] by FhackMar 2, 2022 03:52 AM 4 307 Mar 2, 2022 03:52 AM
Last Post: Fhack
[C] by alexa872Sep 7, 2021 12:28 PM 5 287 Sep 7, 2021 12:28 PM
Last Post: duxv5600
[C] by wayofAKMay 29, 2020 02:55 PM 1 187 May 29, 2020 02:55 PM
Last Post: akali