Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 09-26-2023, 19:04
Avi_RE Avi_RE is offline
Friend
 
Join Date: Nov 2017
Posts: 32
Rept. Given: 1
Rept. Rcvd 4 Times in 2 Posts
Thanks Given: 30
Thanks Rcvd at 52 Times in 17 Posts
Avi_RE Reputation: 4
.NET dll hooking

Hello Mate
Anyone know how to hook x64 .Net dlls. I tried several github projects but no luck

https://i.ibb.co/bQ3XWVL/ee.jpg

Thanks
Reply With Quote
  #2  
Old 09-26-2023, 19:17
Kurapica's Avatar
Kurapica Kurapica is offline
VIP
 
Join Date: Jun 2009
Location: Archives
Posts: 198
Rept. Given: 20
Rept. Rcvd 144 Times in 43 Posts
Thanks Given: 74
Thanks Rcvd at 426 Times in 90 Posts
Kurapica Reputation: 100-199 Kurapica Reputation: 100-199
you should try to unpack/deobfuscate it.
Reply With Quote
  #3  
Old 09-26-2023, 20:40
Avi_RE Avi_RE is offline
Friend
 
Join Date: Nov 2017
Posts: 32
Rept. Given: 1
Rept. Rcvd 4 Times in 2 Posts
Thanks Given: 30
Thanks Rcvd at 52 Times in 17 Posts
Avi_RE Reputation: 4
There are some CRC checks in the file so I need to create a hook DLL
Reply With Quote
  #4  
Old 09-26-2023, 21:50
NON NON is offline
Banned User
 
Join Date: Sep 2023
Posts: 77
Rept. Given: 2
Rept. Rcvd 2 Times in 2 Posts
Thanks Given: 30
Thanks Rcvd at 21 Times in 16 Posts
NON Reputation: 2
Quote:
Originally Posted by Avi_RE View Post
There are some CRC checks in the file so I need to create a hook DLL
Just create a loader, or, better yet, try and patch the CRC checks.
DnSpy will take you far in your venture.
Dnlib will be useful for your actual patching. It is worth learning all about this library.
Reply With Quote
  #5  
Old 09-27-2023, 01:25
Kurapica's Avatar
Kurapica Kurapica is offline
VIP
 
Join Date: Jun 2009
Location: Archives
Posts: 198
Rept. Given: 20
Rept. Rcvd 144 Times in 43 Posts
Thanks Given: 74
Thanks Rcvd at 426 Times in 90 Posts
Kurapica Reputation: 100-199 Kurapica Reputation: 100-199
.NET dlls don't have EXPORTS like native DLLs, what do you want to hook exactly ?
Reply With Quote
  #6  
Old 09-27-2023, 02:45
Avi_RE Avi_RE is offline
Friend
 
Join Date: Nov 2017
Posts: 32
Rept. Given: 1
Rept. Rcvd 4 Times in 2 Posts
Thanks Given: 30
Thanks Rcvd at 52 Times in 17 Posts
Avi_RE Reputation: 4
Yes, you are right.
I made some changes in .net DLL but when I run application with modified Files it's not working properly.
If i make changes is runtime via dnspy it's working fine
That's why I need to create a Hook for .net DLLs
Reply With Quote
  #7  
Old 09-27-2023, 04:03
zerotimer zerotimer is offline
Friend
 
Join Date: Sep 2023
Posts: 16
Rept. Given: 9
Rept. Rcvd 4 Times in 1 Post
Thanks Given: 30
Thanks Rcvd at 25 Times in 7 Posts
zerotimer Reputation: 4
Do you only have .NET dll or do you also have an executable which loads DLL?
Reply With Quote
  #8  
Old 09-27-2023, 11:29
Avi_RE Avi_RE is offline
Friend
 
Join Date: Nov 2017
Posts: 32
Rept. Given: 1
Rept. Rcvd 4 Times in 2 Posts
Thanks Given: 30
Thanks Rcvd at 52 Times in 17 Posts
Avi_RE Reputation: 4
Yes executable loads DLL files .
This is a software and i need to patch the DLL to bypass the license check.
The launcher is .NET but most of the code is in C++ libraries. I'm not sure if .NET tries to load version.dll like a typical binary would.

Last edited by Avi_RE; 09-27-2023 at 11:37.
Reply With Quote
  #9  
Old 09-27-2023, 16:55
sendersu sendersu is offline
VIP
 
Join Date: Oct 2010
Posts: 1,305
Rept. Given: 337
Rept. Rcvd 237 Times in 127 Posts
Thanks Given: 340
Thanks Rcvd at 652 Times in 357 Posts
sendersu Reputation: 200-299 sendersu Reputation: 200-299 sendersu Reputation: 200-299
if you want to hook .net managed functions - consider using a library named Harmony2
Reply With Quote
The Following User Says Thank You to sendersu For This Useful Post:
blue_devil (09-27-2023)
  #10  
Old 09-27-2023, 19:34
blue_devil's Avatar
blue_devil blue_devil is offline
Family
 
Join Date: Dec 2011
Location: Observable Universe
Posts: 537
Rept. Given: 110
Rept. Rcvd 73 Times in 46 Posts
Thanks Given: 687
Thanks Rcvd at 895 Times in 297 Posts
blue_devil Reputation: 73
Harmony is a library for patching, replacing and decorating .NET methods during runtime.

Code:
https://harmony.pardeike.net/
https://github.com/pardeike/Harmony
Reply With Quote
  #11  
Old 09-28-2023, 07:09
Especialista Especialista is offline
Guest
 
Join Date: Sep 2023
Posts: 3
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 0 Times in 0 Posts
Especialista Reputation: 0
Sometimes the software checks to see if Harmony is used, so this does not always work. This is more common for games and modules which have license checks. It's best to do a little custom patching or hooking instead of relying on external libraries.
Reply With Quote
Reply


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Windows Api Hooking user1 Source Code 12 12-24-2022 09:57
Hooking WMI (.NET Application) aldente General Discussion 12 08-07-2012 01:32
API Hooking thomasantony General Discussion 5 04-22-2005 11:44
API-hooking MaRKuS-DJM General Discussion 11 03-25-2005 13:27


All times are GMT +8. The time now is 17:34.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )