DInvoke - GitLite

KO | EN

gitlite — search

#javascript #react #ai #typescript #golang #android #machine-learning #macos #nodejs #java #windows #cli #mcp #open-source

DInvoke

(★ 169)

Dynamically invoke arbitrary unmanaged code from managed code without P/Invoke.

파일 탐색기

최종 버전 다운로드 (.zip)

- DInvoke.Data.csproj
- Native.cs
- PE.cs
- Win32.cs
- DInvoke.DynamicInvoke.csproj
- Generic.cs
- Native.cs
- Utilities.cs
- DInvoke.ManualMap.csproj
- Map.cs
- Overload.cs
- DInvoke.Tests.csproj
- DynamicInvokeTests.cs
- GlobalUsings.cs
- ManualMapTests.cs
.gitignore
DInvoke.sln
README.md

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/rasta-mouse/DInvoke

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd DInvoke

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. .NET

보통 추천

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
.NET SDK dotnet 명령어를 쓰기 위한 SDK입니다.

cd DInvoke.Data

이 프로젝트의 관련 파일이 하위 폴더 안에 있어서, 먼저 그 폴더로 이동합니다.

dotnet restore

프로젝트에 필요한 패키지를 내려받습니다.

dotnet run

프로젝트를 빌드하고 바로 실행합니다.

✅ dotnet run 실행 후 터미널에 나타나는 안내 메시지나 주소를 확인하세요.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# D/Invoke

Fork of [D/Invoke by TheWover](https://github.com/TheWover/DInvoke), but refactored to .NET Standard 2.0 and split into individual NuGet packages.

## Why?

The aim of this project is to provide D/Invoke in a more minimalist form.  It only contains the core DynamicInvoke and ManualMap functionality, without all the additional helper methods and delegates.  This help keeps the packages small and lowers the detection surface for AV.

## Examples

### DynamicApiInvoke

Define the delegates and any strucs/enums that you need.  Some common ones are provided in the `DInvoke.Data` namespace.

```c#
[UnmanagedFunctionPointer(CallingConvention.StdCall)]
private delegate Data.Native.NTSTATUS NtOpenProcessDelegate(
    out SafeProcessHandle processHandle,
    Data.Win32.WinNT.ACCESS_MASK desiredAccess,
    Data.Native.OBJECT_ATTRIBUTES objectAttributes,
    CLIENT_ID clientId);

private struct CLIENT_ID
{
    public IntPtr UniqueProcess;
    public IntPtr UniqueThread;
}
```

Initialise the parameters and bundle them into an `object[]`.

```c#
var handle = new SafeProcessHandle();
var oa = new Data.Native.OBJECT_ATTRIBUTES();
var cid = new CLIENT_ID { UniqueProcess = 1234 };

object[] parameters = [ handle, Data.Win32.WinNT.ACCESS_MASK.MAXIMUM_ALLOWED, oa, cid ];
```

Call `DynamicApiInvoke` specifying the DLL name, the API name, the delegate, and the function parameters.  The output data type is specified as a generic, `T`.  Most NT APIs return a type of `NTSTATUS`, which is a `uint`.

```c#
var status = DynamicInvoke.Generic.DynamicApiInvoke<uint>(
    "ntdll.dll",
    "NtOpenProcess",
    typeof(NtOpenProcessDelegate),
    ref parameters);
```

Parameters marked as `out` need to be read out of the `parameters` array and cast back onto the original variable.

```c#
handle = (SafeProcessHandle)parameters[0];
```

### Function Hashing

Use a tool such as [CSharpRepl](https://github.com/waf/CSharpRepl) to import `DInvoke.DynamicInvoke.dll`.  Call `Utilities.GetApiHash` to generate a hash for the desired DLL name and API.

```
> #r "C:\Tools\DInvoke\DInvoke.DynamicInvoke\bin\Debug\netstandard2.0\DInvoke.DynamicInvoke.dll"

> DInvoke.DynamicInvoke.Utilities.GetApiHash("ntdll.dll", 0x123456789)
"9BC00C9AC691986FE3CEEDA6E12F9FB0"

> DInvoke.DynamicInvoke.Utilities.GetApiHash("NtOpenProcess", 0x123456789)
"9713035EC6AE7BB32303F84822AB80AA"
```

Use `GetLoadedModuleAddress` to resolve the address of the DLL and `GetExportAddress` to resolve the address of the target function.

```c#
var hModule = DynamicInvoke.Generic.GetLoadedModuleAddress(
    "9BC00C9AC691986FE3CEEDA6E12F9FB0", // ntdll.dll
    key);

var hPointer = DynamicInvoke.Generic.GetExportAddress(
    hModule,
    "9713035EC6AE7BB32303F84822AB80AA", // NtOpenProcess
    key);
```

The rest of the steps are the same as above, but we call `DynamicFunctionInvoke` instead.

```c#
var status = DynamicInvoke.Generic.DynamicFunctionInvoke<uint>(
    hPointer,
    typeof(NtOpenProcessDelegate),
    ref parameters);
```