3

I am trying to call a function at a specified memory address in c#, here is how I would go about it in C:

typedef void _do(int i);
auto doActor = (_do*)0xAAAABEEF;
doActor(1);

How do I replicate this behavior in C# if at all possible? Very new to C# all help is appreciated.

More in depth explanation of my situation: I am trying to create a tool that helps me automate certain processes within an executable. I decompiled the assembly of the main API and added my functionality (for the most part) by intercepting network packets/spoofing my own. I do not have control over the client side of things, stored in an obfuscated assembly that I can't de-/recompile. I seldomly need to call one or two functions out of this obfuscated assembly and I found the memory addresses of those relevant functions using a debugger but don't know where to go from here in c#.

HelplessAndConfused
  • 33
  • 4
  • 1
    Since C# manages it's own memory, it's not generally a good idea to start referencing memory directly. For your use-case you can store a reference to a function. For example this: var x = () => { return 1; } makes x point to a function that return 1 – Carlo Bos Aug 23 '18 at 18:06
  • 2
    There's way to directly do this in C#, but depending on what you're trying to achieve, there might be alternative solutions. I suggest you update your question with a clear example of what exactly is your problem. – Etienne de Martel Aug 23 '18 at 18:07
  • 3
    Please specify the actual problem you're trying to solve, rather than your proposed solution to the problem. If you're trying to emulate the Actor model, then say so; there are better ways to do that in C# than what you're proposing. First-class functions are well-supported in C#, and manipulating memory addresses is not necessary to support them. – Robert Harvey Aug 23 '18 at 18:13
  • Essential reading: [Managed versus unmanaged](https://stackoverflow.com/questions/3563870/difference-between-managed-and-unmanaged). Once you get it, read also: [Handling unmanaged memory pointers in managed memory](https://www.codeproject.com/Articles/12477/Handling-Unmanaged-Memory-Pointers-in-Managed-Memo) – John Wu Aug 23 '18 at 18:15
  • Specified my situation, thank you all and thank you John Wu for the reading material. Sorry if my terminology/background knowledge is lacking, I am way farther down the rabbit hole than I ever expected. – HelplessAndConfused Aug 23 '18 at 18:21
  • *I seldomly need to call one or two functions out of this obfuscated assembly* I am confused... are the functions that you need to call contained in a .NET assembly, a plain Win32 DLL, or in an .exe? – John Wu Aug 23 '18 at 18:36
  • They are contained in a .NET assembly, my bad. – HelplessAndConfused Aug 23 '18 at 18:44

1 Answers1

3

The closest equivalent to a C function pointer in C# is a delegate. Delegates are managed, but you can convert one from the other with the Marshal.GetDelegateForFunctionPointer method:

public delegate void _do(int i); // the delegate type

var ptr = new IntPtr(0xAAAABEEF);
var doActor = Marshal.GetDelegateForFunctionPointer<_do>(ptr);
doActor(1);

There are limitations tied to this API, however. I suggest you take a look at the documentation.

If you're stuck with a version of .NET older than 4.5, you're going to have to use a different version of GetDelegateForFunctionPointer:

var doActor = (_do)Marshal.GetDelegateForFunctionPointer(ptr, typeof(_do));
Etienne de Martel
  • 34,692
  • 8
  • 91
  • 111