Thursday, June 27, 2013

Injecting .Net Assemblies Into Unmanaged Processes


.Net is a powerful language for developing software quickly and reliably. However, there are certain tasks for which .net is unfit. This paper highlights one particular case, DLL injection. A .net DLL (aka managed DLL) cannot be injected inside a remote process in which the .net runtime has not been loaded. Furthermore, even if the .net runtime is loaded in a process one would like to inject, how can methods within the .net DLL be invoked? What about architecture? Does a 64 bit process require different attention than a 32 bit process? The goal of this paper is to show how to perform all of these tasks using documented APIs. Together we will:

Start the .net clr (common language runtime) in an arbitrary process regardless of bitness.
Load a custom .net assembly in an arbitrary process.
Execute managed code in the context of an arbitrary process.

Read more: Codeproject
QR: Inline image 1