Skip to content

Instantly share code, notes, and snippets.

@enkomio
Created February 27, 2018 07:51
Show Gist options
  • Save enkomio/309c8ab6edb0b64b3012f9ad7f06b841 to your computer and use it in GitHub Desktop.
Save enkomio/309c8ab6edb0b64b3012f9ad7f06b841 to your computer and use it in GitHub Desktop.
compileMethod hook
[MethodImpl(MethodImplOptions.NoInlining)]
internal static uint qtlEIBBYuV(IntPtr \u0020, IntPtr a1, IntPtr \u0020, [MarshalAs(UnmanagedType.U4)] uint \u0020, IntPtr \u0020, ref uint \u0020)
{
// thisi s a pointer to the COREINFO_METHOD_INFO structure
IntPtr ptr = \u0020;
if (P9ZBIKXMsRMxLdTfcG.KOnEge1tX2)
{
ptr = a1;
}
long num;
if (IntPtr.Size == 4)
{
num = (long)Marshal.ReadInt32(ptr, IntPtr.Size * 2); (1)
}
else
{
num = Marshal.ReadInt64(ptr, IntPtr.Size * 2);
}
// load the ILCode address
object obj = P9ZBIKXMsRMxLdTfcG.k6dbsY0qhy[num];
if (obj == null)
{
// proceed with the standard compilation of the method
return P9ZBIKXMsRMxLdTfcG.u8lbx6nt2g(\u0020, a1, \u0020, \u0020, \u0020, ref \u0020);
}
// allocate a pinned memory buffer in order to copy the real IL code
P9ZBIKXMsRMxLdTfcG.QjP40LkcxwMvQVmG1a qjP40LkcxwMvQVmG1a = (P9ZBIKXMsRMxLdTfcG.QjP40LkcxwMvQVmG1a)obj; (2)
IntPtr intPtr = Marshal.AllocCoTaskMem(qjP40LkcxwMvQVmG1a.wsQbTfcGfS.Length);
Marshal.Copy(qjP40LkcxwMvQVmG1a.wsQbTfcGfS, 0, intPtr, qjP40LkcxwMvQVmG1a.wsQbTfcGfS.Length);
if (qjP40LkcxwMvQVmG1a.KJXb28UyS5)
{
// call VirtualProtect if necessary
a1 = intPtr;
a1 = (uint)qjP40LkcxwMvQVmG1a.wsQbTfcGfS.Length;
P9ZBIKXMsRMxLdTfcG.fptEBhe4Kh(\u0020, qjP40LkcxwMvQVmG1a.wsQbTfcGfS.Length, 64, ref P9ZBIKXMsRMxLdTfcG.Tufbd24KkS);
return 0u;
}
// write back the address of the COREINFO_METHOD_INFO.ILCode
Marshal.WriteIntPtr(ptr, IntPtr.Size * 2, intPtr); (3)
// write back the real length, field COREINFO_METHOD_INFO.ILCodeSize
Marshal.WriteInt32(ptr, IntPtr.Size * 3, qjP40LkcxwMvQVmG1a.wsQbTfcGfS.Length); (4)
uint result = 0u;
if (\u0020 != 216669565u || P9ZBIKXMsRMxLdTfcG.iJnbQwwaCg)
{
// call the real compileMethod with the real ILcode
result = P9ZBIKXMsRMxLdTfcG.u8lbx6nt2g(\u0020, a1, \u0020, \u0020, \u0020, ref \u0020); (5)
}
else
{
P9ZBIKXMsRMxLdTfcG.iJnbQwwaCg = true;
}
return result;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment