Injecting into a running .Net 2.0 AppDomain

I am开发者_Go百科 currently attempting to extend the Zune software, in a way that doesn't require that I launch Zune (like ZuneLCDApi).

In order to do so, I need to access one or two variables that Zune has in memory in its running AppDomain.

Crack.Net doesn't offer Zune as a target, and I don't know whether that is because it runs on .Net 2.0, or because it is the child of ZuneLauncher.

Effectively, I want to create a 'proxy' for a few of the variables inside Zune, so I can skip songs, play/pause etc.

So as I understand it, this is what I have to do:

1. Find the Zune AppDomain
2. Inject some code into it
3. Expose the variables I want to work with

How best to go about this? I really wish Zune had a scripting interface! >_<