Ignore specific exception from throwing in C# .NET

Question

Is it possible to make the .NET CLR ignore certain exceptions? Eg the throw would simply be skipped and the function continues on as if nothing happened?

Is it possible to do this without modifying where the code is thrown from? The software is .NET 4.6.1 WinForms.

The reason is due to reverse engineering some malware which has thousands of checksum routines, I require to modify the MSIL code and hence change the checksum, removing all the routines via dnlib scripting would be very time consuming task. If I could block a specific exception I can avoid this time consuming task.

Edit: I remember seeing in some WinForms apps a "An Exception has occured, would you like to continue or exit?" Surely this is what I need, if I can effectively reject the exception and continue on as if it never happened.

Here is an example. How can I enable this?

Example: Note that I am not writing the code. I am editing a compiled exe with dnspy so I can't easily change the code, I have to edit the MSIL byte code by hand.

public void Test(){
  throw new ArgumentException("ignore this");

  MessageBox.Show("Successfully ignored exception");

}

Could it be done by adding an exception handler that somehow returns back to the original throw? — rollsch, Jul 04 '18 at 03:51
Sorry but i dont understand what you mean... what is `REing` ? also what do you mean by `malware which has thousands of checksum routines` ? Though it sounds like its the wrong approach to just have a global ignore on exceptions (even if you could do it, which i dont think you can) — TheGeneral, Jul 04 '18 at 04:07
REing = reverse engineering. I have a .net malware sample I am trying to reverse engineer. I need to modify the MSIL code to make it run, however this breaks the built in checksum routines. I could modify all 2000 checksum routines however this would be time consuming. If I can simply disable a specific exception from being unhandled then I can very easily "disable" all the checksum routines. This or modifying the huge number of routines are the only ways I can modify the code and run it. — rollsch, Jul 04 '18 at 06:47
Are these always the same exceptions? Then you could probably just nop out the corresponding byte pattern. — thehennyy, Jul 04 '18 at 09:51
It is looking like scripting their removal is the best bet. I can use msil search for a specific exception and nop that plus x instructions before it — Joseph, Jul 05 '18 at 21:08

Xaphas · Answer 1 · 2018-07-04T12:45:05.387

You cannot "ignore" exceptions in the way that you want it. If you're iterating through your routines though, you could always just skip the one iteration that throws the exception... like:

while(condition)
{
    try
    {
        // your iteration
    }
    catch (Exception)
    {
        /* don't do a catch, so it will jump back to your while statement and just 
        try the next one */
    }
}

This should have the effect that you want, since it will just ignore iterations that would otherwise stop your program from running. Hope this helps!

EDIT:

You can decompile the code and change the source code from there. Take a look at GEOCHET's answer on how to do that:

How do I decompile a .NET EXE into readable C# source code?

I am not writing the code. I cannot just edit it. There are 2000 static constructors which would need to be edited via MSIL byte code patching. — Joseph, Jul 04 '18 at 09:00

score 0 · Answer 2 · answered Jul 04 '18 at 07:38

You can obviously put an if check inside Catch to operate custom functionality on a specific exception -

            try
            {
                // function which you will operate
            }
            catch (Exception ex)
            {
                if (ex is StackOverflowException) //(Type your exception type here)
                {
                    //log this if you want
                }
                else
                {
                    throw; //or handle as per your requirement
                }

            }

I am not writing the code. I cannot just edit it. There are 2000 static constructors which would need to be edited via MSIL byte code patching. — Joseph, Jul 04 '18 at 09:00

Ignore specific exception from throwing in C# .NET

2 Answers2