dnSpy oddities

[LaptoniC]

Hi,
I am trying to reverse a net app for fun and tried to use dnSpy for the job. I found the methods in dll and edit the method and saved the file. When I run with dnSpy debugger, it works. If I run it directly my patch doesn't have any effect. I figured out it is loading files from C:\Windows\assembly\NativeImagesxx. I tried to ngen.exe but now apps don't open at all. What am I doing wrong? Sorry it's been a long time I have touched those tools I am kind a lost lol

[the_beginner]

It's depend how you patch the file, it can be also the location of the file. I remember I was Patching one file, everything was fine, show registered in the debugger, I closed open without dnspy, not working, again in dnspy and then I saw, dnspy loaded always a new dll. Try to patch the file in dnspy, if it is not work, find the location of the bytes and patch it with a hexeditor.

[ymg2006]

you will have to understand how GAC and ngen works, you'll have to probe about signatures in .net (signed assembly).
as far as i know dnSpy is working perfectly.

[tonyweb]

@LaptoniC
Start by uninstalling the file from the GAC ...

ngen uninstall AssemblyName

... and see if it makes any difference.

Regards,
Tony

[LaptoniC]

Thanks @tonyweb it worked when I uninstalled it.

[s0me0n3]

When I play around with that kind of things, I locate the corresponding path and files inside the win dir with this small regfile content:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion]
"DisableCacheViewer"=dword:00000001

Maybe it's helpful for somebody.