.NET Hooking – Harmonizing Managed Territory

Research by: Jiri Vinopal

Key Points

• Check Point Research (CPR) provides an introduction to .NET managed hooking using the Harmony library.


• We cover the most common examples of implementation using different types of Harmony patches.


• The practical example using Harmony hooking to defeat the notorious “ConfuserEx2” obfuscator results in the “ConfuserEx2_String_Decryptor” tool.


• CPR reveals a neat trick how to combine both debugging and hooking using the Harmony library (Harmony hooking from the dnSpyEx debugging context).

Introduction

For a malware researcher, …

check check point examples harmony hooking implementation introduction key key points library managed obfuscator patches point points research results tool types