开发者

How to defeat C# GetCallingAssembly().Location security

开发者 https://www.devze.com 2023-04-06 20:52 出处:网络
I\'m trying to load and execute an dynamically external assembly against its developer\'s wishes. It does a hash check on GetCallingAssembly().Location and closes.

I'm trying to load and execute an dynamically external assembly against its developer's wishes. It does a hash check on GetCallingAssembly().Location and closes.

The assembly is frequently updated so开发者_Python百科 editing of the IL code to bypass this check would be possible, but would need to be done programmatically before it is loaded. This would be unreliable, and I couldn't find adequate documentation on any tools that could be used to easily patch it. I could also bypass the check altogether by just calling the later function directly if I could parse a few strings out of the assembly. This would be easier, but is the least unreliable, if anything significant was changed my code would break.

AFAIK there's no easy way I can control what is returned by GetCallingAssembly().Location of a child process. I have full privileges over the executing computer if that helps.

Otherwise I hoped I could use some sort of hook or Windows 7 feature to such to redirect a C# FileStream read from one file to another, but I don't know how I'd go about this.

Please point me towards some ideas. I know this kind of check is stupid and should be easy to bypass with the right knowledge.

Thanks


This site probably isn't the best place to note this is done against the writers wishes as we are all devs here.

However if I was to have to bypass something for a legal reason (research, old software, etc) I would need to patch it in a case like this. Since the call is in to a system .net library you cannot control the return without using a runtime loader to patch that function in the system lib, or patch the function in the resulting assembly. There are ways to hook the system libraries, but I'm not sure if what's intended here is legal, so I won't comment.

0

精彩评论

暂无评论...
验证码 换一张
取 消