Geek Answers Handbook

How many bytes does my function use? (WITH#)

I would like to calculate how many bytes my function fills so I can inject it into another process using CreateRemoteThread (). As soon as I know the number of bytes, I can write them to the remote process using a function pointer. I found an article on the Internet (see http://www.codeproject.com/KB/threads/winspy.aspx#section_3 , chapter III), where they do the following in C ++:

// ThreadFunc // Notice: - the code being injected; //Return value: password length static DWORD WINAPI ThreadFunc (INJDATA *pData) { //Code to be executed remotely } // This function marks the memory address after ThreadFunc. static void AfterThreadFunc (void) { }

Then they calculate the number of bytes of ThreadFunc using:

 const int cbCodeSize = ((LPBYTE) AfterThreadFunc - (LPBYTE) ThreadFunc);

Using cbCodeSize , they allocate memory in the remote process for the ThreadFunc entered and write a copy of ThreadFunc to the allocated memory:

 pCodeRemote = (PDWORD) VirtualAllocEx( hProcess, 0, cbCodeSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE ); if (pCodeRemote == NULL) __leave; WriteProcessMemory( hProcess, pCodeRemote, &ThreadFunc, cbCodeSize, &dwNumBytesXferred );

I would like to do this in C #. :) I tried to create delegates, get their pointers and subtract them as follows:

  // Thread proc, to be used with Create*Thread public delegate int ThreadProc(InjectionData param); //Function pointer ThreadFuncDeleg = new ThreadProc(ThreadFunc); ThreadFuncPtr = Marshal.GetFunctionPointerForDelegate(ThreadFuncDeleg); //FunctionPointer AfterThreadFuncDeleg = new ThreadProc(AfterThreadFunc); IntPtr AfterThreadFuncDelegPtr= Marshal.GetFunctionPointerForDelegate(AfterThreadFuncDeleg); //Number of bytes int cbCodeSize = (AfterThreadFuncDelegPtr.ToInt32() - ThreadFuncPtr.ToInt32())*4 ;

This just doesn't seem right, as I get a static number no matter what I do with the code.
My question is, if possible, how to calculate the number of bytes, the function code fills in C #?

Thanks in advance.

+4
source share
1 answer

I do not think that this is possible due to dynamic optimization and code generation in .NET. You can try to measure the length of the IL-code, but when you try to measure the length of the code, depending on the machine, in general, it will fail.

By "fail" I mean that you cannot get the correct size, which gives any value using this technique dynamically.

Of course, you can find how NGEN, JIT, pdb structure work and try to measure. You can determine the size of your code by examining the generated machine code in VS, for example.

How to see assembly code generated by JIT using Visual Studio

If you really need to determine the size, start with NET Internals and Code Injection / NET Internals and Native Compiling , but I can’t imagine why you ever wanted this.

Remember that all the insides on how JIT works can be changed, so the dependent solution may be broken by any future version of .NET.

If you want to stick with IL: check out the Profiling Interfaces (CLR profiling APIs) and some old articles: Rewrite MSIL code on the fly with the .NET Framework profiling APIs and No code can hide from profiling APIs in the .NET Framework 2.0 . There are also several topics about the CLR profiling API here on SO.

But the easiest way to explore the reflection API assembly is you want MethodBody . Thus, you can check the Length MethodBody.GetILAsByteArray , and you will find the length of the method in IL commands.

+7
source

More articles:


All Articles