nektra / Deviare-InProc

Deviare In Process Instrumentation Engine
http://nektra.com/products/deviare-api-hook-windows/deviare-in-process/
Other
328 stars 83 forks source link

How to hook .NET methods in remote process? #19

Closed zonya1 closed 6 years ago

zonya1 commented 6 years ago

Hi, I would like to hook certain methods in a .NET executable while it is running. I found this sample code:

object o = cHook.Hook(typeof(SampleClass), "Call", new Type[] { typeof(string), typeof(string) }, typeof(MySampleClass), "Call", new Type[] { typeof(string), typeof(string) });

But this of course only works inside the current executable, is it possible to achieve the same thing in a remote process using Deviare In-Proc? I know it can also inject DLL's, but as far as I can see, that will only work with a native DLL, and I'd first just like to know if I can do this with C# instead.

Helios-vmg commented 6 years ago

You can add native entry points to a managed DLL, which would allow it to be loaded by LoadLibrary(), and thus be injected into a remote process.

zonya1 commented 6 years ago

Thank you! I managed to get a managed DLL injected and working. But when hooking a method in a certain class, does it has to be 'public' for it to work, or will private/internal access-modifiers work too? Right now the hooking code above crashes the process for some reason :/

lxm470 commented 6 years ago

Is it possible that managed DLL loaded by LoadLibrary() and unloaded by FreeLibrary() without crash?

mxmauro commented 6 years ago

Resources in .NET are managed by the GC. If you unload the library, it would leak and lead to crashes.

DonetCracker commented 4 years ago

Thank you! I managed to get a managed DLL injected and working. But when hooking a method in a certain class, does it has to be 'public' for it to work, or will private/internal access-modifiers work too? Right now the hooking code above crashes the process for some reason :/

Could you show your solution?