Click here to Skip to main content
15,887,907 members
Home / Discussions / .NET (Core and Framework)
   

.NET (Core and Framework)

 
GeneralRe: Standalone .NET framework exe Pin
LostTime764-Aug-13 10:19
LostTime764-Aug-13 10:19 
GeneralRe: Standalone .NET framework exe Pin
Dave Kreskowiak20-Jul-13 9:47
mveDave Kreskowiak20-Jul-13 9:47 
GeneralRe: Standalone .NET framework exe Pin
LostTime7620-Jul-13 10:30
LostTime7620-Jul-13 10:30 
GeneralRe: Standalone .NET framework exe Pin
Dave Kreskowiak20-Jul-13 10:38
mveDave Kreskowiak20-Jul-13 10:38 
GeneralRe: Standalone .NET framework exe Pin
LostTime7620-Jul-13 11:01
LostTime7620-Jul-13 11:01 
AnswerRe: Standalone .NET framework exe Pin
Eddy Vluggen20-Jul-13 23:36
professionalEddy Vluggen20-Jul-13 23:36 
AnswerRe: Standalone .NET framework exe Pin
jschell21-Jul-13 9:50
jschell21-Jul-13 9:50 
GeneralRe: Standalone .NET framework exe Pin
LostTime7621-Jul-13 14:12
LostTime7621-Jul-13 14:12 
I happened to read the white paper on boxed app, and it stated that they were hooking all the file system calls and creating a virtual file system within the process memory.

I didn't want to tinker with that, because intercepting all file system calls would be fairly complicated to get correct. I stopped into their forums, and the fact that there are threads that say "bug here... Found bug here... This doesn't work in this way..., etc." suggests to me that its not a robust way to do things.

Also note, that the article where they packaged .NET was when .NET 3.5 was available. Who knows what has changed since then.

I am fairly new to API hooking, so it if it possible to hook all file system calls easily and reliably like they apparently do, I can be persuaded otherwise.

However, note that I did some hooking tests to see what the Win32 LoadLibrary was doing. It turns out that it used ZwOpenFile to open a file, but never calls ZwReadFile. This means that windows is somehow internally reading the file without using its own API, unless I am missing something. If this is true, I have no clue how BoxedApp is seemingly intercepting ZwOpenFile and modifying the PHANDLE parameter to point to a valid file handle in memory. Sure if you knew the layout and structure of Win32 file handles AND can create your own arbitrary, valid Win32 handles (which I am not aware that you can), then maybe you can do what they are doing.

With that said, I don't know how they are hooking the file system calls if ReadFile is never called from LoadLibrary. If you could hook ReadFile, then you would have a much better chance of getting something done, because I would think you could just manually return some byte arrays from memory to the LoadLibrary call.
QuestionInvoke from MASM Assembly Language Pin
Derek Tortonian16-Jul-13 7:57
Derek Tortonian16-Jul-13 7:57 
AnswerRe: Invoke from MASM Assembly Language Pin
Pete O'Hanlon16-Jul-13 8:38
mvePete O'Hanlon16-Jul-13 8:38 
GeneralRe: Invoke from MASM Assembly Language Pin
Derek Tortonian17-Jul-13 7:14
Derek Tortonian17-Jul-13 7:14 
GeneralRe: Invoke from MASM Assembly Language Pin
Dave Kreskowiak17-Jul-13 7:26
mveDave Kreskowiak17-Jul-13 7:26 
GeneralRe: Invoke from MASM Assembly Language Pin
Derek Tortonian17-Jul-13 7:28
Derek Tortonian17-Jul-13 7:28 
GeneralRe: Invoke from MASM Assembly Language Pin
MicroVirus17-Jul-13 11:24
MicroVirus17-Jul-13 11:24 
QuestionMysql query with date conditions not working in server Pin
ven75312-Jul-13 4:10
ven75312-Jul-13 4:10 
AnswerRe: Mysql query with date conditions not working in server Pin
NotPolitcallyCorrect12-Jul-13 4:52
NotPolitcallyCorrect12-Jul-13 4:52 
AnswerRe: Mysql query with date conditions not working in server Pin
jschell12-Jul-13 13:42
jschell12-Jul-13 13:42 
AnswerMessage Closed Pin
14-Jul-13 2:26
Member 1015486914-Jul-13 2:26 
GeneralRe: Mysql query with date conditions not working in server Pin
Eddy Vluggen14-Jul-13 3:08
professionalEddy Vluggen14-Jul-13 3:08 
QuestionMaster-detail table access vb.net Pin
dmtp11-Jul-13 0:10
dmtp11-Jul-13 0:10 
AnswerRe: Master-detail table access vb.net Pin
ZurdoDev17-Jul-13 7:53
professionalZurdoDev17-Jul-13 7:53 
QuestionRelationship of dll and interface Pin
bfis10813710-Jul-13 0:57
bfis10813710-Jul-13 0:57 
AnswerRe: Relationship of dll and interface Pin
David Fiser10-Jul-13 6:30
David Fiser10-Jul-13 6:30 
QuestionTextChanged Event Won't Fire First Time Pin
Hypermommy9-Jul-13 4:49
Hypermommy9-Jul-13 4:49 
QuestionError Could not copy "pay.mdf". Exceeded retry count of 10. Failed. Pin
chdboy8-Jul-13 18:47
chdboy8-Jul-13 18:47 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.