1

I'm trying to make some changes to .Net dll (note: dll is mixed mode module) used by an exe, ProtectionID detected nothing, so I happily jumped into dnSpy and made changes.

I ran executable with dnSpy debugger and everything was working as expected. However when I saved module and tried to run executable, it worked as if no changes were made.

I double checked, but module saved correctly, and x64dbg shows that it is loaded on runtime. So how is this possible?

K. Kowalczyk
  • 111
  • 2
  • are you sure your changes were actually saved? compare the saved file against the original – Igor Skochinsky Aug 18 '17 at 18:54
  • yeah, changes were saved, saved file is also ~30% bigger, but so far all files I saved with dnSpy were 10-30% bigger. I even opened modified dll in Reflector instead, changes are there. they just don't seem to affect execution if I don't use dnSpy debugger. – K. Kowalczyk Aug 18 '17 at 19:36
  • 1
    I think we need a bit more info. What arę the changes you've made? Are they for sure executed always? Are you sure that the dll is loaded from where you put the new one - check ProcessMonitor log. – Paweł Łukasik Aug 19 '17 at 06:35
  • @PawełŁukasik Huh I think I found a reason, it appears to use native images. I'm not sure if I can generate modified native image without source, especially if it's mixed-mode module. – K. Kowalczyk Aug 19 '17 at 12:48
  • Did you check the GAC? – mrexodia Aug 20 '17 at 09:58

1 Answers1

0

Found the reason and I feel quite retarded now since it was so obvious. It was NativeImage being loaded and removing all generated images actually made my changes load. Thanks @PawełŁukasik for pointing me in right direction.

K. Kowalczyk
  • 111
  • 2