Exetools

Exetools (https://forum.exetools.com/index.php)
-   General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)
-   -   .net modification of a method (without decompilation) (https://forum.exetools.com/showthread.php?t=15253)

Shub-Nigurrath 09-18-2013 15:52

.net modification of a method (without decompilation)
 
Hi all,
here the request.

Suppose I have a method like GetMACAddress() in a .net program and suppose also I don't want (or can't) decompile it to a svn project and recompile it.

What I have is reflector and an IL editor (or even IDA).

Now the mentioned method returns the MAC address of the machine into a string, what I would like to do is to patch the function with something like the following: just return a string I decide and nothing else.

GetMACAddress() {
return "0A-00-00-00-00";
}

the question is therefore twofold.
1. how can I add this string (the fake MAC) to the resources (I tried several resource editor or reflexil but can't do this on a .net exe).
2. how can I code a function like the one I said, take the IL code and patch the original function.

Suggestions and tools are welcome

Thanks
Shub

Smoke 09-18-2013 15:58

reflexil -> repace all with code... -> ret ""0A-00-00-00-00";

or IL

ldsrt 0A-00-00-00-00;
ret

wilson bibe 09-18-2013 17:37

Did you tried the CFF explorer, there are a resource editor in it.

Shub-Nigurrath 09-18-2013 18:39

CFF damn, I forgot of it .. thanks

sendersu 09-18-2013 18:58

ReflexIL, CFF Explorer, all cool to change bytes
but what if assembly is signed? :)

wilson bibe 09-18-2013 19:44

If the assembly is signed you can use the StrongName_Killer coded by codecraker, or Strong Name Remover coded by Andrea bertolotto, Reflector, etc....

LaDidi 09-20-2013 20:43

@Shub-Nigurrath:
May you send us your exemple ?
Regards.

Shub-Nigurrath 09-21-2013 00:54

I'll see what can I share.

Kurapica 10-15-2013 21:04

Shub, If you need any help then you can send me a pm :)


All times are GMT +8. The time now is 10:23.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX