1

I need to hook a particular .NET function in a target process. So I have my C# Dll ready to be injected, but I need a way to make the hook once the dll is loaded.

PROBLEM: There is no such things as dllmain in C#

RESOLUTION: Here is what I tried > C# equivalent of DllMain in C (WinAPI)

I don't have 50 reputations, so I can't comment @mheyman answer. But I did all what he suggested, compiled every thing in one Dll, which I then injected in my target process. But it blocks at the level of:

 LaunchDll(dll, len, "MyNamespace.MyClass", "DllMain"); in dllmain.cpp

I can't go further, I get the error

This application has requested the Runtime to terminate it in an unusual way. Please contact the application’s support team for more information

The LaunchDll function is never executed, and if I modify it so that it immediately returns, I still get the same behavior, which makes me think the problem is at the call to LaunchDll.

Here is the output I get from the Just in time debugger of Visual Studio:

...

'target.exe' (Win32): Loaded 'C:\Windows\System32\api-ms-win-core-processthreads-l1-1-1.dll'. Symbols loaded. 'target.exe' (Win32): Loaded 'C:\Windows\System32\api-ms-win-core-file-l1-2-0.dll'. Symbols loaded. 'target.exe' (Win32): Loaded 'C:\Windows\System32\api-ms-win-core-timezone-l1-1-0.dll'. Symbols loaded. 'target.exe' (Win32): Loaded 'C:\Windows\System32\api-ms-win-core-file-l2-1-0.dll'. Symbols loaded. 'target.exe' (Win32): Loaded 'C:\Windows\System32\api-ms-win-core-synch-l1-2-0.dll'. Symbols loaded. The thread 0xc27c has exited with code 3 (0x3). The thread 0x828c has exited with code 3 (0x3). The thread 0xb47c has exited with code 3 (0x3). The thread 0xbce0 has exited with code 3 (0x3). The thread 0xb974 has exited with code 3 (0x3). The thread 0x68d4 has exited with code 3 (0x3). The thread 0xc4e8 has exited with code 3 (0x3). The thread 0xc748 has exited with code 3 (0x3). The thread 0xc198 has exited with code 3 (0x3). The thread 0xa708 has exited with code 3 (0x3). The thread 0x8870 has exited with code 3 (0x3). The thread 0xc02c has exited with code 3 (0x3). The thread 0xc3fc has exited with code 3 (0x3). The thread 0x995c has exited with code 3 (0x3). The thread 0xb790 has exited with code 3 (0x3). The thread 0xb9b8 has exited with code 3 (0x3). The program '[47324] target.exe' has exited with code 3 (0x3).

Here is the code of the .NET Dll:

namespace MyNameSpace {
public class MyClass {
    public static void DllMain() {
        string text1 = "random Text from .NET Dll \n ";
        System.IO.File.WriteAllText(@"D:\\TestFromCSharp.txt", text1);
   }
}

}

Bonjour123
  • 1,421
  • 12
  • 13
  • The "This application has requested the Runtime to terminate it in an unusual way" error simply means the application has called the "abort()" function and since that isn't called in your code (I assume), it means the DLL loader has called it. I tend to see it when I have mixed up 32-bit and 64-bit code or perhaps, when I've mixed up runtime libraries in C/C++ code. – mheyman Feb 18 '19 at 17:52
  • But everything is in 64 bits, and anyway, it doesn't even enter in the LaunchDll function, so doesn't load my Dll. It seems that what it doesn't like is inside the code you posted as an answer, but I presume that it worked for you, so where could be the problem in my case ? – Bonjour123 Feb 19 '19 at 00:57
  • @mheyman Maybe I haven't been clear (your comment shows it), I did a clear copy-paste of your solution, I didn't change anything. So no, I do not call abort(), nor mix 32-bit with 64-bit code nor use runtime libraries in the C/C++ code. So right now, I don't know what I could try further.. – Bonjour123 Feb 19 '19 at 07:25
  • @mheyman I tried every thing, even changed of Dll, now I'm stuck. Could you please provide me with a working code (dllmain.cpp, launcherDll.cpp, Dll and config files), so that I can compare and find the origin of the problem ? It would help me greatly ! – Bonjour123 Feb 19 '19 at 10:16
  • 1
    That has been working (with changes in class name) for years in a project of mine - I just rebuilt it yesterday to verify. I cannot reproduce your failure. – mheyman Feb 20 '19 at 16:40
  • Yes, you're right, the fact that I couldn't enter in the launchDll made me think at was at this level, but after moving the dll out of resources, and then using Assembly::LoadFrom in launchDll , then it worked. Thank you for the help ! – Bonjour123 Feb 20 '19 at 18:00

0 Answers0