Devlooped.Injector 1.0.0-beta

Allows injecting .NET code into any Windows process.

Heavily based on Cory Plott's Snoop.

Usage:

• Install:

install-package Devlooped.Injector

The $(PlatformTarget) or $(Platform) properties of the referencing project are used to determine which version (x86 or x64) of the boostrap.dll assembly will be referenced. If any of those specify either x86 or x64, the assembly will be automatically referenced.

The targets automatically include as content both the assembly as well as a helper Injector.exe executable which you can use to inject into processes that have a different bitness than the calling one.

• Launch:

var targetProcess = System.Diagnostics.Process.GetProcessesByName("notepad.exe")[0];

Injector.Launch(
    // IntPtr of the main window handle of the process to inject
    targetProcess.MainWindowHandle,
    // The full path to the .NET assembly to load in the remote process
    Assembly.GetExecutingAssembly().Location,
    // Full type name of the public static class to invoke in the remote process
    "MyApp.Startup",
    // Name of the static method in that class to invoke in the remote process
    "Start");

When referencing the package from an AnyCPU project, a helper Injector.exe is provided in both x86 and x64 bitness versions and included in the referencing project as content, copied automatically to the output under Injector\[x86|x64]\Injector.exe. This allows you to run the relevant executable that matches the target process bitness. This executable receives the same parameters as the Launch method shown above.

For example, to detect a target process bitness, you could use the following interop code:

static class NativeMethods
{
    [DllImport("kernel32.dll", SetLastError = true, CallingConvention = CallingConvention.Winapi)]
    [return: MarshalAs(UnmanagedType.Bool)]
    internal static extern bool IsWow64Process([In] IntPtr process, [Out] out bool wow64Process);
}

And then use the following code (note it's similar to the API-based one above) to inject into it:

var targetProcess = System.Diagnostics.Process.GetProcessesByName("notepad.exe")[0];

NativeMethods.IsWow64Process(targetProcess.Handle, out var isWow);
var platform = isWow ? "x86" : "x64";

Process.Start(Path.Combine("Injector", platform, "Injector.exe"),
    targetProcess.MainWindowHandle + " " +
    Assembly.GetExecutingAssembly().Location + " " +
    typeof(Startup).FullName + " " +
    $"{nameof(Startup.Start)}:hello:42:true");

Optionally, the injected method call can also receive parameters, in a {method}:arg1:arg2:argN format:

var targetProcess = System.Diagnostics.Process.GetProcessesByName("notepad.exe")[0];

Injector.Launch(
    // IntPtr of the main window handle of the process to inject
    targetProcess.MainWindowHandle,
    // The full path to the .NET assembly to load in the remote process
    Assembly.GetExecutingAssembly().Location,
    // Full type name of the public static class to invoke in the remote process
    "MyApp.Startup",
    // Name of the static method in that class to invoke in the remote process
    "Start:hello:42:true");

See Program.cs for complete example.

NOTE: parameter type conversion is supported and happens via the TypeConverter associated with the parameter type.

Sponsors

Learn more about GitHub Sponsors