Hooking to managed method with easyhook?

Jun 20, 2014 at 2:28 PM
Hi,

As far as I understand EasyHook allows to hook only native functions visible via getprocaddress... Is there a way to hook managed method, like Enumerable.ToArray()...?

Thanks in advance,
Andrew
Jun 22, 2014 at 10:14 AM
As the code is now you cannot do it.

It is possible, however you need to do some stuff with overriding the JIT compiler. You could use the Microsoft debugging APIs to insert stuff too, but I don't think that would be ideal. I haven't done this myself but have looked into it a few times.
Jun 22, 2014 at 11:47 AM
Thank you. Does it mean that I need to hook to some native jitcompile method? Is there an example with easyhook or reference to a function? As far as I understand the hooking library should be loaded before methods are jitcompiled... So, it means I should forget about attach/detach...?

I have tried this approach http://www.codeproject.com/Articles/463508/NET-CLR-Injection-Modify-IL-Code-during-Run-time. I was able to modify a function with some limitations, however the following 2 critical things does not allow to proceed:
1) any modification of CommonLanguageRuntime module cause crashes (fatal CLR error exception).
2) was able to replace byte code of a function in my application by byte code from another function from the same library. It worked. After I tried to replace by byte code from a function in my injected library (the same signature, even the same plain code as in the application, no strings, no other calls, no refs to variables, etc.). This did not work and crashed the target application with badimageformat exception. The exception means the byte code was wrong, however, I was able to execute this byte code successfully within the space of the injected library.