NetDasm - A tool to disassemble and patch .NET assemblies

Screenshot - Screen.jpg

Introduction

This article illustrates a little tool for disassembling a .NET assembly IL code and making some patches.

Background

For my application, I have used Mono.Cecil, a very powerful library for modifying IL code. If you want more info, visit the Cecil homepage.

Another Cecil article I found to be helpful is the one by ronnyek: MonoCecilChapter1.asp.

Using the code

You only need to load an assembly and look at all the types that it contains. When you click on one type, its methods and some information appear in the right. You can delete a type, delete a method, or edit the code of a method. In the Edit Code form, you can watch the IL code, remove a sentence, or insert a new sentence.

The basic code for using Cecil is:

AssemblyDefinition assembly = AssemblyFactory.GetAssembly("assembly.exe");
 
//Gets all types of the MainModule of the assembly

foreach(TypeDefinition type in assembly.MainModule.Types)
{
    if(type.Name != "<Module>")
    {
        //Gets all methods of the current type

        foreach(MethodDefinition method in type.Methods)
        {
            //Gets the CilWorker of the method for working with CIL instructions

            CilWorker worker = method.Body.CilWorker;
            //Creates the MSIL instruction for inserting the sentence

                   Instruction insertSentence = worker.Create(OpCodes.Ldstr, "Text");
 
 
            //Inserts the insertSentence instruction before the first //instruction

            method.Body.CilWorker.InsertBefore(method.Body.Instructions[0], 
                                               insertSentence);
        }
        //Import the modifying type into the AssemblyDefinition

        assembly.MainModule.Import(type);
    }    
} 
 
//Save the new assembly

AssemblyFactory.SaveAssembly(assembly, "new.exe");

Points of Interest

I want to improve the program and add some more options like methods insertion, feature to show C# code (like Reflector), and an improved instructions insertion.

History

2/06/2007 - Update version

Code for IL tool added (only C# code)
Support for edit instructions
Filter for instructions
Some minor changes and bugs fixed

1/06/2007 - Update version

Instructions documentation and auto-complete
Some interface changes
Multi-instructions remover

31/05/2007 - First version

You must Sign In to use this message board.


Per page

New Line / Multiple Lines
tekhead

22:08 12 Jan '09

Is there a way to either edit an instruction or add a new instruction that contains multiple lines with netDASM? Thanks
Sign In·View Thread·PermaLink

Re: New Line / Multiple Lines
rongchaua

10:58 17 Apr '09

You can use .Net Reflector + its plugin Reflexil to edit IL instructions. Regards. http://rongchaua.net
Sign In·View Thread·PermaLink

i cant insert instruction
sujithkumarsl

19:38 17 Apr '08

hi i tried to add instruction by using the "insert instruction" option. but its showing error like invalid parameter "opcode" My small attempt...
Sign In·View Thread·PermaLink

Godd stuff
hhir1

0:05 22 Oct '07

Thanx for the article.
It is always very useful to have the tools to look under the hood and fix (patch) things.

For that purpose I'm currently using
XenoCode-Fox (http://www.xenocode.com/Products/Fox/Default.aspx[], they also provide a free community version). Fox can also decompile to IL but also to C# and VB. However it has no means to directly patch something... But it's still very useful just to look under the hood.

Cheers
Hans-Jürgen Schmidt

Replace Method???
rongchaua

13:40 15 Jul '07

This is only a question about Mono.Cecil. Do you think that we can use Mono.Cecil to replace a method in assembly with a string? For example, I have this instruction.

******
MessageBox.Show(Language.GetText(12345))
******

Can I replace this Language.GetText() Method with a string "Hello World" so that I can receive

******
MessageBox.Show("Hello World")
******

I don't know very much about Mono.Cecil. Thank for your help.

Re: Replace Method???
jonbratz

22:23 18 Jul '07

yes you can.
Sign In·View Thread·PermaLink	1.00/5

Re: Replace Method???
jonbratz

6:31 24 Jul '07

take look at this screenshot. Even if the blog is in french, the software and associated source code is in english. http://sebastien.lebreton.free.fr/blog/index.php?/archives/11-Reflexil-v0.3.html[^] This is Reflexil, a Reflector plugin which is able to replace a method on the fly in an assembly.
Sign In·View Thread·PermaLink	5.00/5

Try Reflexil
jonbratz

23:01 2 Jul '07

I found Reflexil on the Mono.Cecil author blog, which is a Reflector Plugin which do more and is fully integrated. Operands can be either of primitive type or parameters/variables references. http://evain.net/blog/articles/2007/07/02/reflexil-easy-assembly-patching[^] Jon Bratz
Sign In·View Thread·PermaLink	5.00/5

meta-data corruption?
Philox

3:06 6 Jun '07

Hey, I tried just for the fun of it, to remove System.Windows.Forms.DataGridView. When I try to add the assembly as reference and try to build my solution I get the follow message: Error 1 Unexpected error reading metadata from file 'c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll' -- ''
Sign In·View Thread·PermaLink

Re: meta-data corruption?
Fco. Javier Marin

3:09 6 Jun '07

Hum, remove a type from a library can corrupt the entire library.Try to change only the code and test if it works.
Sign In·View Thread·PermaLink

Re: meta-data corruption?
Philox

23:43 6 Jun '07

Argumenting a method works perfectly
Sign In·View Thread·PermaLink

More Function Please
rongchaua

8:55 1 Jun '07

First, you've made a great tool. It works very well. The GUI is ok. Second, can you add more function at EditCode 1. Search Text 2. Edit IL Instruction (not remove and then insert) Last, thanx you for this tool. Great.
Sign In·View Thread·PermaLink

Re: More Function Please
Fco. Javier Marin

6:33 2 Jun '07

In the new version I have added the things that you said.
Sign In·View Thread·PermaLink

Patching signed assemblies ?
Vertyg0

21:57 31 May '07

Is it possible to patch signed assembly and not to get next exception:


An unhandled exception of type 'System.IO.FileLoadException' occurred in Unknown Module.

Additional information: Could not load file or assembly 'TestApp, Version=1.0.0.0, Culture=neutral, PublicKeyToken=f20ee6ae21b7015e' or one of its dependencies. Strong name validation failed. (Exception from HRESULT: 0x8013141A)

Anyway really nice app ... you could add autocompleate to Opcode combobox in InsertInstruction ...

Re: Patching signed assemblies ?
Fco. Javier Marin

0:59 1 Jun '07

I have tried load signed assemblies and I don't get error...
Sign In·View Thread·PermaLink	1.00/5

Securing my Application
jfdoubell

20:50 31 May '07

Very nice work on NetDasm! How could I protect my application from programs like NetDasm so people can't dissasemble my code and reverse engineer my program?
Sign In·View Thread·PermaLink

Re: Securing my Application
Fco. Javier Marin

0:54 1 Jun '07

You can sign your applications and obfuscate the source code
Sign In·View Thread·PermaLink

Nice work
David Sleeckx

12:21 31 May '07

First of all, nice program, it's always nice to see people dive more into the code behind the code.

I have a few tips, absolutely not ment as criticism, but to help you improve the quality of your future programs.

Try and give more meaningfull names to the controls on your forms, it will help improve the readability of your code a lot.
Try extracting the program logic from the user interface code, with WPF on the way, you don't want to rewrite your entire program when you decide to take advantage of the next UI. You never know
Another thing you might want to take into account is exception handling, I didn't find a single one in the code, but got a few while running it. Never ever trust user input.
And last, \n can be used to add carriage returns to your strings

Keep up the good work,
David

Re: Nice work [modified]
Fco. Javier Marin

12:24 31 May '07

Thanks, I have made this application in two hours and I dont check the things that you say. If I have time, I will improve these things. ----------------- Apuntes, trabajos y resumenes
Sign In·View Thread·PermaLink	3.80/5