rendari
January 23rd, 2008, 16:36
Right, so I've had this question kicking around inside my head for quite a while now, and I haven't been able to figure out the answer. So, I'm gonna post it here in hopes someone can help me:
I was reading this article on CodeBreakers awhile ago (its about .NET anti-RCE)
http://www.codebreakers-journal.com/content/view/123/97/
and please note the part where the author mentions calling getJit, and then getting the compileMethod address from there. Now, there are some functions in mscorwks.dll that I would like to hook as well. Is there a similar thing such as getJit(which is in mscorjit.dll) that will give me a pointer to a struct full of the addresses of vital functions in mscorwks.dll? Because I've been searching for some time for something like that. I've already done the obvious, such as going over the sources at www.koders.com, poring over the (limited) MSDN documentation, and reversing the exports of mscorwks.dll in IDA.
So, is there anything I'm missing here? Or does no one have any idea on how to hook functions in mscorwks.dll? I'm gonna keep looking; will post if I figure it out.
PS I already know about dotNet hook, and that's not what I am looking for. The author there isn't hooking mscorwks.dll; he is simply inserting his own code and redirecting the metadata to point to it. Completely different story.
I was reading this article on CodeBreakers awhile ago (its about .NET anti-RCE)
http://www.codebreakers-journal.com/content/view/123/97/
and please note the part where the author mentions calling getJit, and then getting the compileMethod address from there. Now, there are some functions in mscorwks.dll that I would like to hook as well. Is there a similar thing such as getJit(which is in mscorjit.dll) that will give me a pointer to a struct full of the addresses of vital functions in mscorwks.dll? Because I've been searching for some time for something like that. I've already done the obvious, such as going over the sources at www.koders.com, poring over the (limited) MSDN documentation, and reversing the exports of mscorwks.dll in IDA.
So, is there anything I'm missing here? Or does no one have any idea on how to hook functions in mscorwks.dll? I'm gonna keep looking; will post if I figure it out.
PS I already know about dotNet hook, and that's not what I am looking for. The author there isn't hooking mscorwks.dll; he is simply inserting his own code and redirecting the metadata to point to it. Completely different story.