教你怎么用Mono Cecil - 动态注入 （注意代码的注释）

原文 教你怎么用Mono Cecil - 动态注入 （注意代码的注释）

使用 Mono Cecil 进行反编译:using Mono.Cecil;
using Mono.Cecil.Cil;

//......

AssemblyDefinition asm = AssemblyFactory.GetAssembly("MyLibrary.dll");
foreach (TypeDefinition type in asm.MainModule.Types)
{
   if (type.Name == "Class1") //获取类名
   {
     foreach (MethodDefinition method in type.Methods) 遍历方法名称
     {
       Console.WriteLine(".maxstack {0}", method.Body.MaxStack);
       foreach (Instruction ins in method.Body.Instructions)
       {
         Console.WriteLine("L_{0}: {1} {2}", ins.Offset.ToString("x4"),
           ins.OpCode.Name,
           ins.Operand is String ? String.Format("\"{0}\"", ins.Operand) : ins.Operand);
       }
     }
   }
}
输出：

.maxstack 8
L_0000: nop
L_0001: ldstr "Hello, World!"
L_0006: call System.Void System.Console::WriteLine(System.String)
L_000b: nop
L_000c: ret

nop ---->

ldstr ---->

call ---->

nop ---->

ret ---->

=================》下面我们开始进行注入了

AssemblyDefinition asm = AssemblyFactory.GetAssembly("MyLibrary.dll");
foreach (TypeDefinition type in asm.MainModule.Types)
{
   if (type.Name == "Class1")
   {
     foreach (MethodDefinition method in type.Methods)
     {
       if (method.Name == "Test")
       {
         foreach (Instruction ins in method.Body.Instructions)
         {
           if (ins.OpCode.Name == "ldstr" && (string)ins.Operand == "Hello, World!") //如果发现操作数为"Hello, World! ===>改为"Hello, C#!";
           {
             ins.Operand = "Hello, C#!";
           }
         }
       }
     }
   }
}

AssemblyFactory.SaveAssembly(asm, "Test.dll");

用 Lutz Roeder's Reflector 打开 Test.dll 看看结果。
.method public hidebysig instance void Test() cil managed
{
   .maxstack 8
   L_0000: nop
   L_0001: ldstr "Hello, C#!"
   L_0006: call void [mscorlib]System.Console::WriteLine(string)
   L_000b: nop
   L_000c: ret
}

达成所愿~~~~~

完成代码修改以后，我们玩一个更难点的，注入额外的代码。(好像有点做病毒的意思，呵呵~)

任务目标是在 Console.WriteLine("Hello, World!"); 前注入 Console.WriteLine("Virus? No!");，还好这不是真的破坏性代码

AssemblyDefinition asm = AssemblyFactory.GetAssembly("MyLibrary.dll");
foreach (TypeDefinition type in asm.MainModule.Types)
{
   if (type.Name == "Class1")
   {
     foreach (MethodDefinition method in type.Methods)
     {
       if (method.Name == "Test")
       {
         foreach (Instruction ins in method.Body.Instructions)
         {
           if (ins.OpCode.Name == "ldstr" && (string)ins.Operand == "Hello, World!") //关键的地方，找到目的地
           {
             CilWorker worker = method.Body.CilWorker;

             Instruction insStr = worker.Create(OpCodes.Ldstr, "Virus? NO!");
             worker.InsertBefore(ins, insStr);

             MethodReference refernce = asm.MainModule.Import(typeof(Console).GetMethod("WriteLine",
               new Type[]{typeof(string)}));

             Instruction insCall = worker.Create(OpCodes.Call, refernce);
             worker.InsertAfter(insStr, insCall);

             Instruction insNop = worker.Create(OpCodes.Nop);
             worker.InsertAfter(insCall, insNop);

             break;
           }
         }
       }
     }
   }
}
用反射测试一下修改后的程序集。
AssemblyFactory.SaveAssembly(asm, "Test.dll");

Assembly testAssembly = Assembly.LoadFrom("Test.dll");
Type class1Type = testAssembly.GetType("MyLibrary.Class1");
Object o = Activator.CreateInstance(class1Type);
class1Type.InvokeMember("Test", BindingFlags.Instance | BindingFlags.Public | BindingFlags.InvokeMethod, null, o, null);4. 获取程序集信息
AssemblyDefinition asm = AssemblyFactory.GetAssembly("Learn.Library.dll");

Console.WriteLine("Kind:{0}", asm.Kind);
Console.WriteLine("Runtime:{0}", asm.Runtime);
输出：
Kind:Dll
Runtime:NET_2_0

利用 ModuleDefinition.Image 属性，我们可以获取程序集几乎全部的细节信息。包括 CLIHeader、DebugHeader、DOSHeader、FileInformation、HintNameTable、ImportAddressTable、ImportLookupTable、ImportTable、MetadataRoot、PEFileHeader、PEOptionalHeader、ResourceDirectoryRoot、Sections、TextSection 等。