How to Patch (IL Edit) of Assembles loaded from Resource

[th3tuga]

Originally Posted by cracki

I'm currently debugging a .NET DLL that, upon execution, loads some dependencies using the:
C#:

Assembly.Load

from its own resources. These new References (DLLs) appear in the dnSpy list, but how can I edit them?

You need to follow the techniques similar to the ones described here, although it's for another protector:

https://insinuator.net/2018/04/reversing-and-patching-net-binaries-with-embedded-references/

[cracki]

Originally Posted by th3tuga

You need to follow the techniques similar to the ones described here, although it's for another protector:

Thank you for your response and the guidance you provided!


If I save a version of the DLL that has been extracted from the embedded state alongside the program and somehow (as per the techniques mentioned in the tutorial you provided) remove the "module initializer" so that "the embedded references will be ignored when running the binary" will the program then use the file I saved and patched?

[th3tuga]

Originally Posted by cracki

Thank you for your response and the guidance you provided!


If I save a version of the DLL that has been extracted from the embedded state alongside the program and somehow (as per the techniques mentioned in the tutorial you provided) remove the "module initializer" so that "the embedded references will be ignored when running the binary" will the program then use the file I saved and patched?

Yes it will work.
As long as the executable has import references to functions in the patched DLL. You should save it in the same folder the calling executable is in.
This is same principle why proxy dll or DLL hijacking works.

[NON]

Originally Posted by th3tuga

Yes it will work.
As long as the executable has import references to functions in the patched DLL. You should save it in the same folder the calling executable is in.
This is same principle why proxy dll or DLL hijacking works.

I do not understand. Can someone explain with a simple example?

[th3tuga]

Originally Posted by Gregory Morse

I do not understand. Can someone explain with a simple example?

Dump the dll that is loaded from the resource, using DnSpy after it's loaded.
Then edit the dumped dll with your patches.
Remove the dll module initialize including the load statements from the exe.
Place the edited dll in the same folder with the exe and run. That's all.

I also use the nick Selya on some forums, since you cannot PM me here.
I respond only to known people though (no crack requests please).