Showing preview only (5,105K chars total). Download the full file or copy to clipboard to get everything.
Repository: advanced-threat-research/DotDumper
Branch: main
Commit: 82ab3750f81b
Files: 193
Total size: 4.6 MB
Directory structure:
gitextract_4_7p2e3s/
├── DotDumper/
│ ├── ArgumentHandler.cs
│ ├── Config.cs
│ ├── DotDumper.csproj
│ ├── Helpers/
│ │ ├── ArgumentHelper.cs
│ │ ├── AssemblyMapper.cs
│ │ ├── Hashes.cs
│ │ ├── LogEntryHelper.cs
│ │ ├── MissedAssemblyDumper.cs
│ │ ├── RaceConditionHandler.cs
│ │ ├── Serialise.cs
│ │ └── StagnationHandler.cs
│ ├── HookHandlers/
│ │ ├── Activator/
│ │ │ └── ActivatorHooks.cs
│ │ ├── Assembly/
│ │ │ └── AssemblyHooks.cs
│ │ ├── Console/
│ │ │ └── ConsoleHooks.cs
│ │ ├── Convert/
│ │ │ └── ConvertHooks.cs
│ │ ├── Directory/
│ │ │ └── DirectoryHooks.cs
│ │ ├── Environment/
│ │ │ └── EnvironmentHooks.cs
│ │ ├── File/
│ │ │ └── FileHooks.cs
│ │ ├── GenericHookHelper.cs
│ │ ├── MethodBase/
│ │ │ └── MethodBaseHooks.cs
│ │ ├── Path/
│ │ │ └── PathHooks.cs
│ │ ├── Process/
│ │ │ └── ProcessHooks.cs
│ │ ├── ResourceManager/
│ │ │ └── ResourceManagerHooks.cs
│ │ ├── Thread/
│ │ │ └── ThreadHooks.cs
│ │ └── Type/
│ │ ├── TypeHooks.cs
│ │ └── TypeHooksHelper.cs
│ ├── Hooks/
│ │ ├── Hook.cs
│ │ ├── HookManager.cs
│ │ ├── InteropFunctions.cs
│ │ ├── OriginalManagedFunctions.cs
│ │ └── OriginalUnmanagedFunctions.cs
│ ├── Logger.cs
│ ├── Models/
│ │ ├── Argument.cs
│ │ ├── AssemblyObject.cs
│ │ ├── Hash.cs
│ │ ├── LogEntry.cs
│ │ └── UnmanagedMethodInfo.cs
│ ├── Pipes/
│ │ └── PipeManager.cs
│ ├── Program.cs
│ ├── Properties/
│ │ └── AssemblyInfo.cs
│ ├── app.config
│ ├── bin/
│ │ └── Debug/
│ │ ├── DotDumper.exe.config
│ │ ├── DotDumper.pdb
│ │ ├── System.Buffers.xml
│ │ ├── System.Memory.xml
│ │ ├── System.Numerics.Vectors.xml
│ │ ├── System.Runtime.CompilerServices.Unsafe.xml
│ │ └── System.Security.Cryptography.Pkcs.xml
│ ├── obj/
│ │ ├── Debug/
│ │ │ ├── .NETFramework,Version=v4.7.2.AssemblyAttributes.cs
│ │ │ ├── .NETFramework,Version=v4.8.AssemblyAttributes.cs
│ │ │ ├── DesignTimeResolveAssemblyReferences.cache
│ │ │ ├── DesignTimeResolveAssemblyReferencesInput.cache
│ │ │ ├── DotDumper.csproj.AssemblyReference.cache
│ │ │ ├── DotDumper.csproj.CopyComplete
│ │ │ ├── DotDumper.csproj.CoreCompileInputs.cache
│ │ │ ├── DotDumper.csproj.FileListAbsolute.txt
│ │ │ └── DotDumper.pdb
│ │ └── x64/
│ │ └── Debug/
│ │ ├── .NETFramework,Version=v4.7.2.AssemblyAttributes.cs
│ │ ├── DesignTimeResolveAssemblyReferencesInput.cache
│ │ ├── DotDumper.csproj.AssemblyReference.cache
│ │ ├── DotDumper.csproj.CoreCompileInputs.cache
│ │ ├── DotDumper.csproj.FileListAbsolute.txt
│ │ └── DotDumper.pdb
│ └── packages.config
├── DotDumper.sln
├── LICENSE
├── README.md
└── packages/
├── PeNet.2.9.9/
│ ├── .signature.p7s
│ └── PeNet.2.9.9.nupkg
├── PeNet.Asn1.2.0.0/
│ ├── .signature.p7s
│ └── PeNet.Asn1.2.0.0.nupkg
├── System.Buffers.4.5.1/
│ ├── .signature.p7s
│ ├── LICENSE.TXT
│ ├── System.Buffers.4.5.1.nupkg
│ ├── THIRD-PARTY-NOTICES.TXT
│ ├── lib/
│ │ ├── net461/
│ │ │ └── System.Buffers.xml
│ │ ├── netcoreapp2.0/
│ │ │ └── _._
│ │ ├── netstandard1.1/
│ │ │ └── System.Buffers.xml
│ │ ├── netstandard2.0/
│ │ │ └── System.Buffers.xml
│ │ └── uap10.0.16299/
│ │ └── _._
│ ├── ref/
│ │ ├── net45/
│ │ │ └── System.Buffers.xml
│ │ ├── netcoreapp2.0/
│ │ │ └── _._
│ │ ├── netstandard1.1/
│ │ │ └── System.Buffers.xml
│ │ ├── netstandard2.0/
│ │ │ └── System.Buffers.xml
│ │ └── uap10.0.16299/
│ │ └── _._
│ ├── useSharedDesignerContext.txt
│ └── version.txt
├── System.Diagnostics.Process.4.3.0/
│ ├── .signature.p7s
│ ├── System.Diagnostics.Process.4.3.0.nupkg
│ ├── ThirdPartyNotices.txt
│ ├── dotnet_library_license.txt
│ ├── lib/
│ │ ├── MonoAndroid10/
│ │ │ └── _._
│ │ ├── MonoTouch10/
│ │ │ └── _._
│ │ ├── xamarinios10/
│ │ │ └── _._
│ │ ├── xamarinmac20/
│ │ │ └── _._
│ │ ├── xamarintvos10/
│ │ │ └── _._
│ │ └── xamarinwatchos10/
│ │ └── _._
│ ├── ref/
│ │ ├── MonoAndroid10/
│ │ │ └── _._
│ │ ├── MonoTouch10/
│ │ │ └── _._
│ │ ├── netstandard1.3/
│ │ │ ├── System.Diagnostics.Process.xml
│ │ │ ├── de/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── es/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── fr/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── it/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── ja/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── ko/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── ru/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── zh-hans/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ └── zh-hant/
│ │ │ └── System.Diagnostics.Process.xml
│ │ ├── netstandard1.4/
│ │ │ ├── System.Diagnostics.Process.xml
│ │ │ ├── de/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── es/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── fr/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── it/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── ja/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── ko/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── ru/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── zh-hans/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ └── zh-hant/
│ │ │ └── System.Diagnostics.Process.xml
│ │ ├── xamarinios10/
│ │ │ └── _._
│ │ ├── xamarinmac20/
│ │ │ └── _._
│ │ ├── xamarintvos10/
│ │ │ └── _._
│ │ └── xamarinwatchos10/
│ │ └── _._
│ └── runtimes/
│ └── win7/
│ └── lib/
│ └── netcore50/
│ └── _._
├── System.Memory.4.5.5/
│ ├── .signature.p7s
│ ├── LICENSE.TXT
│ ├── System.Memory.4.5.5.nupkg
│ ├── THIRD-PARTY-NOTICES.TXT
│ ├── lib/
│ │ ├── net461/
│ │ │ └── System.Memory.xml
│ │ ├── netcoreapp2.1/
│ │ │ └── _._
│ │ ├── netstandard1.1/
│ │ │ └── System.Memory.xml
│ │ └── netstandard2.0/
│ │ └── System.Memory.xml
│ ├── ref/
│ │ └── netcoreapp2.1/
│ │ └── _._
│ ├── useSharedDesignerContext.txt
│ └── version.txt
├── System.Numerics.Vectors.4.5.0/
│ ├── .signature.p7s
│ ├── LICENSE.TXT
│ ├── System.Numerics.Vectors.4.5.0.nupkg
│ ├── THIRD-PARTY-NOTICES.TXT
│ ├── lib/
│ │ ├── MonoAndroid10/
│ │ │ └── _._
│ │ ├── MonoTouch10/
│ │ │ └── _._
│ │ ├── net46/
│ │ │ └── System.Numerics.Vectors.xml
│ │ ├── netcoreapp2.0/
│ │ │ └── _._
│ │ ├── netstandard1.0/
│ │ │ └── System.Numerics.Vectors.xml
│ │ ├── netstandard2.0/
│ │ │ └── System.Numerics.Vectors.xml
│ │ ├── portable-net45+win8+wp8+wpa81/
│ │ │ └── System.Numerics.Vectors.xml
│ │ ├── uap10.0.16299/
│ │ │ └── _._
│ │ ├── xamarinios10/
│ │ │ └── _._
│ │ ├── xamarinmac20/
│ │ │ └── _._
│ │ ├── xamarintvos10/
│ │ │ └── _._
│ │ └── xamarinwatchos10/
│ │ └── _._
│ ├── ref/
│ │ ├── MonoAndroid10/
│ │ │ └── _._
│ │ ├── MonoTouch10/
│ │ │ └── _._
│ │ ├── net45/
│ │ │ └── System.Numerics.Vectors.xml
│ │ ├── net46/
│ │ │ └── System.Numerics.Vectors.xml
│ │ ├── netcoreapp2.0/
│ │ │ └── _._
│ │ ├── netstandard1.0/
│ │ │ └── System.Numerics.Vectors.xml
│ │ ├── netstandard2.0/
│ │ │ └── System.Numerics.Vectors.xml
│ │ ├── uap10.0.16299/
│ │ │ └── _._
│ │ ├── xamarinios10/
│ │ │ └── _._
│ │ ├── xamarinmac20/
│ │ │ └── _._
│ │ ├── xamarintvos10/
│ │ │ └── _._
│ │ └── xamarinwatchos10/
│ │ └── _._
│ ├── useSharedDesignerContext.txt
│ └── version.txt
├── System.Runtime.CompilerServices.Unsafe.6.0.0/
│ ├── .signature.p7s
│ ├── LICENSE.TXT
│ ├── System.Runtime.CompilerServices.Unsafe.6.0.0.nupkg
│ ├── THIRD-PARTY-NOTICES.TXT
│ ├── buildTransitive/
│ │ ├── netcoreapp2.0/
│ │ │ └── System.Runtime.CompilerServices.Unsafe.targets
│ │ └── netcoreapp3.1/
│ │ └── _._
│ ├── lib/
│ │ ├── net461/
│ │ │ └── System.Runtime.CompilerServices.Unsafe.xml
│ │ ├── net6.0/
│ │ │ └── System.Runtime.CompilerServices.Unsafe.xml
│ │ ├── netcoreapp3.1/
│ │ │ └── System.Runtime.CompilerServices.Unsafe.xml
│ │ └── netstandard2.0/
│ │ └── System.Runtime.CompilerServices.Unsafe.xml
│ └── useSharedDesignerContext.txt
└── System.Security.Cryptography.Pkcs.6.0.1/
├── .signature.p7s
├── LICENSE.TXT
├── System.Security.Cryptography.Pkcs.6.0.1.nupkg
├── THIRD-PARTY-NOTICES.TXT
├── buildTransitive/
│ ├── netcoreapp2.0/
│ │ └── System.Security.Cryptography.Pkcs.targets
│ └── netcoreapp3.1/
│ └── _._
├── lib/
│ ├── net461/
│ │ └── System.Security.Cryptography.Pkcs.xml
│ ├── net6.0/
│ │ └── System.Security.Cryptography.Pkcs.xml
│ ├── netcoreapp3.1/
│ │ └── System.Security.Cryptography.Pkcs.xml
│ ├── netstandard2.0/
│ │ └── System.Security.Cryptography.Pkcs.xml
│ └── netstandard2.1/
│ └── System.Security.Cryptography.Pkcs.xml
├── runtimes/
│ └── win/
│ └── lib/
│ ├── net461/
│ │ └── System.Security.Cryptography.Pkcs.xml
│ ├── net6.0/
│ │ └── System.Security.Cryptography.Pkcs.xml
│ ├── netcoreapp3.1/
│ │ └── System.Security.Cryptography.Pkcs.xml
│ ├── netstandard2.0/
│ │ └── System.Security.Cryptography.Pkcs.xml
│ └── netstandard2.1/
│ └── System.Security.Cryptography.Pkcs.xml
└── useSharedDesignerContext.txt
================================================
FILE CONTENTS
================================================
================================================
FILE: DotDumper/ArgumentHandler.cs
================================================
using System;
using System.IO;
using System.Reflection;
namespace DotDumper
{
/// <summary>
/// This class handles user-provided arguments by parsing them, and updating the fields in the Config class when need be. At last, a check is performed to ensure that the required arguments are provided.
/// </summary>
class ArgumentHandler
{
#region Argument markers and descriptions
/// <summary>
/// The marker for the sample path (equals "-file")
/// </summary>
public const string SamplePathMarker = "-file";
/// <summary>
/// The description for the sample path
/// </summary>
public const string SamplePathDescription = "The complete path to the file to launch. This is the only mandatory argument, if the provided file has\n\t\tan entry point. Note that providing only a single CLI argument with the file's location also works!";
/// <summary>
/// The marker for the logging folder name (equals "-log")
/// </summary>
public const string LoggingFolderNameMarker = "-log";
/// <summary>
/// The description of the logging folder name
/// </summary>
public const string LoggingFolderNameDescription = "The name of the folder to place artifacts in, which will be placed within the same folder as DotDumper.\n\t\tIf this argument is missing, the sample's file name will be used.";
/// <summary>
/// The marker for the deprecated function inclusion/exclusion
/// </summary>
public const string DeprecatedFunctionMarker = "-deprecated";
/// <summary>
/// The description for the deprecated function inclusion/exclusion
/// </summary>
public const string DeprecatedFunctionDescription = "Hook deprecated functions, needs to be true or false. The default value is true";
/// <summary>
/// The marker for the argument which decides if the loaded hooks should be displayed
/// </summary>
public const string LogHooksMarker = "-displayHooks";
/// <summary>
/// The description for the logging of all loaded hooks
/// </summary>
public const string LogHooksDescription = "Print all hooked functions upon startup, needs to be true or false. The default value is true";
/// <summary>
/// The race condition marker, which indicates an overwrite of the delay on the race condition timer
/// </summary>
public const string RaceConditionDueTimeMarker = "-raceTime";
/// <summary>
/// The decription of the race condition delay argument
/// </summary>
public const string RaceConditionDueTimeDescription = "The amount of milliseconds that are between the hook and re-hook of Invoke-related functions.\n\t\tThe default value is 20";
/// <summary>
/// Decides if the entry point of the binary should be ignored
/// </summary>
public const string OverrideEntryPointMarker = "-overrideEntry";
/// <summary>
/// The description of the override functionality
/// </summary>
public const string OverrideEntryPointDescription = "Defines if the default entry point should be overridden, needs to be true or false. The default value\n\t\tis false. The use of -fqcn and -functionName is mandatory with this argument, whereas -args and\n\t\t-argc are optional (though both -args and -argc need to be used together when they are used).";
/// <summary>
/// The marker for the fully qualified class name (including the namespace)
/// </summary>
public const string DllFullyQualifiedClassNameMarker = "-fqcn";
/// <summary>
/// The description of the fully qualified class name (including the namespace)
/// </summary>
public const string DllFullyQualifiedClassDescription = "The fully qualified class, including namespace, to find the function in. Only used when overriding\n\t\tthe entry point. Needs to be used together with -functionName.";
/// <summary>
/// The marker for the function name
/// </summary>
public const string DllFunctionNameMarker = "-functionName";
/// <summary>
/// The description for the function name's description
/// </summary>
public const string DllFunctionNameDescription = "The function name to call, excluding types and parameters, within the fully qualified class.\n\t\tOnly used when overriding the entry point. Needs to be used together with -fqcn.";
/// <summary>
/// The marker for the arguments
/// </summary>
public const string PayloadArgumentsMarker = "-args";
/// <summary>
/// The description for the arguments
/// </summary>
public const string PayloadArgumentsDescription = "The arguments for the function, providing the type and value at once, split by a pipe,\n\t\tsuch as int|7, double|3.14, or string|myValue\n\t\tThe following types are supported: bool, byte, sbyte, char, decimal, double, float, int, uint, long,\n\t\tulong, short, ushort, string, as well as arrays of each of those types. Arrays are indicated using \"[]\"\n\t\tdirectly after the type, such as \"string[]\". The values are to be split using commas.\n\t\tAn example: string[]|string1,string2,string3\n\t\tNull is also possible, but note that this value (or lack thereof) should not be capitalised.\n\t\tNeeds to be used together with -argc.";
/// <summary>
/// The index of the first argument in the provided array of DotDumper arguments by the user
/// </summary>
private static int PayloadArgumentsIndex = -1;
/// <summary>
/// The marker for the argument count
/// </summary>
public const string PayloadArgumentCountMarker = "-argc";
/// <summary>
/// The description for the argument count
/// </summary>
public const string PayloadArgumentCountDescription = "The number of arguments that are provided, as an integer. Needs to be used together with -args.";
/// <summary>
/// The amount of arguments, as provided by the user
/// </summary>
private static int PayloadArgumentCount = -1;
/// <summary>
/// The marker to decide if sleep calls should be skipped
/// </summary>
public const string SleepSkipMarker = "-sleepSkip";
/// <summary>
/// The description for the sleep skip functionality
/// </summary>
public const string SleepSkipDescription = "Defines if Thread.Sleep calls need to be skipped, needs to be true or false. The default value is true.";
/// <summary>
/// The marker to decide if logs should be printed to the console
/// </summary>
public const string ConsolePrintingMarker = "-console";
/// <summary>
/// The description for the optional console logging functionality
/// </summary>
public const string ConsolePrintingDescription = "Defines if the logging should be printed to the console window or not. The default value is true.";
/// <summary>
/// The help marker
/// </summary>
public const string HelpMarker = "-help";
/// <summary>
/// The description of the help marker
/// </summary>
public const string HelpDescription = "Prints the help menu. This cannot be used in combination with other options, as they will be ignored.";
#endregion
/// <summary>
/// A helper function to combine a marker and a description, including the required newlines and tabs
/// </summary>
/// <param name="marker">The marker to combine with the description</param>
/// <param name="description">The description to combine with the marker</param>
/// <returns>The combined marker and description</returns>
private static string CombineMarkerAndDescription(string marker, string description)
{
return marker + "\n" +
"\t\t" + description + "\n";
}
/// <summary>
/// A helper function to get the complete help message as a single string
/// </summary>
/// <returns>The complete help message</returns>
private static string GetHelpMessage()
{
//Initialises the program's version, and a note that all arguments are case sensitive
string help = Program.VERSION + "\n" +
"Note that all arguments are cases sensitive!\n";
//Adds all the markers and their descriptions into the help message
help += CombineMarkerAndDescription(SamplePathMarker, SamplePathDescription);
help += CombineMarkerAndDescription(LoggingFolderNameMarker, LoggingFolderNameDescription);
help += CombineMarkerAndDescription(DeprecatedFunctionMarker, DeprecatedFunctionDescription);
help += CombineMarkerAndDescription(LogHooksMarker, LogHooksDescription);
help += CombineMarkerAndDescription(RaceConditionDueTimeMarker, RaceConditionDueTimeDescription);
help += CombineMarkerAndDescription(OverrideEntryPointMarker, OverrideEntryPointDescription);
help += CombineMarkerAndDescription(DllFullyQualifiedClassNameMarker, DllFullyQualifiedClassDescription);
help += CombineMarkerAndDescription(DllFunctionNameMarker, DllFunctionNameDescription);
help += CombineMarkerAndDescription(PayloadArgumentsMarker, PayloadArgumentsDescription);
help += CombineMarkerAndDescription(PayloadArgumentCountMarker, PayloadArgumentCountDescription);
help += CombineMarkerAndDescription(SleepSkipMarker, SleepSkipDescription);
help += CombineMarkerAndDescription(ConsolePrintingMarker, ConsolePrintingDescription);
help += CombineMarkerAndDescription(HelpMarker, HelpDescription);
//Adds the well known message to keep the console open, if it wasn't launched via a terminal
help += "\nPress any key to exit...";
//Return the complete message
return help;
}
/// <summary>
/// Checks if the help marker is used as an argument at any point, or if the given array is null or empty. If any of the mentioned conditions is met, the help menu is printed, after which DotDumper will await for the user to press any key, leading to DotDumper's shutdown.
/// </summary>
/// <param name="args">The args array to check for the help parameter</param>
private static void CheckHelp(string[] args)
{
//Declare the variable which will incidate if the help marker has been found
bool help = false;
//If the provided argument is null or empty, the help menu must be shown, as one at least needs to provide a file to DotDumper
if (args == null || args.Length == 0)
{
help = true;
}
else
{
//If it is not null nor empty, iterate over all arguments
for (int i = 0; i < args.Length; i++)
{
//Check if the current argument equals the helpmarker
if (args[i].Equals(HelpMarker))
{
//Set the help variable to true
help = true;
//Break the loop, as the help marker has been found
break;
}
}
}
//If the help variable is true
if (help)
{
//Get and write the help message
Console.WriteLine(GetHelpMessage());
//Wait for any user input
Console.ReadKey();
//Exit
Environment.Exit(0);
}
//If the variable is false, nothing has to be done
}
/// <summary>
/// Checks (in the listed order) if the given value is a file in the current directory, the directory of DotDumper, or if it is a full path.
/// </summary>
/// <param name="value">The (partial) path and file name of the target file</param>
private static void CheckFile(string value)
{
//Check if the sample is located in the current working directory
string filePath = Directory.GetCurrentDirectory() + @"\" + value;
if (File.Exists(filePath))
{
Config.SamplePath = filePath;
}
//Check if the sample is located in the same folder as DotDumper
filePath = Path.GetDirectoryName(Assembly.GetEntryAssembly().Location) + @"\" + value;
if (File.Exists(filePath))
{
Config.SamplePath = filePath;
}
//Check if a full path is given, but only after the two other defined directions have been checked, as the Assembly object can only be loaded with a full path, not a relative one
if (File.Exists(value))
{
Config.SamplePath = value;
}
//Only throw the exception if the sample path hasn't been set (meaning the sample hasn't been found)
if (Config.SamplePath == null)
{
//Throw an error if none of the above options results in a match with a file on the user's file system
throw new Exception("The provided sample path at \"" + value + "\" does not exist, and cannot be found in the current working directory nor in DotDumper's folder!");
}
}
/// <summary>
/// Parses the arguments and sets the config fields that need to be updated based on the arguments. The checks afterwards ensure that only correct combinations of arguments are allowed, or an error is thrown.
/// </summary>
/// <param name="args"></param>
public static void ParseArguments(string[] args)
{
//Check if the help marker is provided. If so, this function does not return
CheckHelp(args);
/*
* Ensure that a single argument leading to the path is possible, when the size of args equals 1,
* it is to be redefined as an array with the size of two, where the first argument is "-file"
*/
try
{
//Only attempt this if there is a single argument
if (args.Length == 1)
{
//Call the check file function, which throws an exception if it fails
CheckFile(args[0]);
/*
* If this code is reached, the function call above was successful, otherwise I'd throw an exception.
* Because of that, the normal CLI parsing can continue if the string array is set again, with the file
* path marker as the first argument, and its value as the second, as if it were done manually
*/
args = new string[] { SamplePathMarker, args[0] };
}
}
catch (Exception)
{
/*
* The sole argument was not equal to the file path marker. There is no need to handle this error, other than
* ignoring it.
*/
}
//Open the try block to handle wrong argument exceptions
try
{
//Declare i prior to the loop, as it is also used outside of the loop in some cases
int i;
for (i = 0; i < args.Length; i++)
{
//Get the current argument, in lower case
string arg = args[i];
//Check if the next index exists, as the marker is always accompanied by at least one argument
if (NextIndexExists(args, i))
{
//Get the value of the next index, which is known to exist at this point
string value = args[i + 1];
//Handle all marker options (aside from the help one, which was handled before the try block)
if (IsEqual(arg, SamplePathMarker))
{
CheckFile(value);
}
else if (IsEqual(arg, LoggingFolderNameMarker))
{
Config.LoggerFolder = value;
}
else if (IsEqual(arg, DeprecatedFunctionMarker))
{
try
{
Config.IncludeDeprecatedFunctions = Convert.ToBoolean(value);
}
catch (Exception)
{
throw new Exception("The boolean to determine if deprecated functions should also be hooked is not a valid boolean: \"" + value + "\"!");
}
}
else if (IsEqual(arg, LogHooksMarker))
{
try
{
Config.LogHooks = Convert.ToBoolean(value);
}
catch (Exception)
{
throw new Exception("The boolean to determine if the hooks should be logged is not a valid boolean: \"" + value + "\"!");
}
}
else if (IsEqual(arg, RaceConditionDueTimeMarker))
{
try
{
int raceConditionTime = Convert.ToInt32(value);
if (raceConditionTime <= 0)
{
throw new Exception();
}
Config.RaceConditionDueTime = raceConditionTime;
}
catch (Exception)
{
throw new Exception("The integer to determine the duration of the time the timer should wait before rehooking invoke related functions is not a valid integer with a size of more than zero: \"" + value + "\"!");
}
}
else if (IsEqual(arg, OverrideEntryPointMarker))
{
try
{
Config.OverrideEntryPoint = Convert.ToBoolean(value);
}
catch (Exception)
{
throw new Exception("The boolean to determine if a user-specified entry point should be used is not a valid boolean: \"" + value + "\"!");
}
}
else if (IsEqual(arg, DllFullyQualifiedClassNameMarker))
{
Config.DllFullyQualifiedClassName = value;
}
else if (IsEqual(arg, DllFunctionNameMarker))
{
Config.DllFunctionName = value;
}
else if (IsEqual(arg, PayloadArgumentsMarker))
{
PayloadArgumentsIndex = i + 1;
}
else if (IsEqual(arg, PayloadArgumentCountMarker))
{
try
{
int argCount = Convert.ToInt32(value);
if (argCount <= 0)
{
throw new Exception();
}
PayloadArgumentCount = argCount;
}
catch (Exception)
{
throw new Exception("The integer that indicates the amount of arguments the function requires is not a valid integer that is bigger than one: \"" + value + "\"!");
}
}
else if (IsEqual(arg, SleepSkipMarker))
{
try
{
Config.SleepSkip = Convert.ToBoolean(value);
}
catch (Exception)
{
throw new Exception("The boolean to determine if sleep calls need to be skipped is not a valid boolean: \"" + value + "\"!");
}
}
else if (IsEqual(arg, ConsolePrintingMarker))
{
try
{
Config.PrintLogsToConsole = Convert.ToBoolean(value);
}
catch (Exception)
{
throw new Exception("The boolean to determine if logs need to be printed to the console window is not a valid boolean: \"" + value + "\"!");
}
}
}
}
#region Mandatory value checks
//If no sample was provided, an error is thrown
if (Config.SamplePath == null)
{
throw new Exception("No file has been provided! Use \"" + SamplePathMarker + "\" to specify the file, or use \"" + HelpMarker + "\" to show the help menu!");
}
//If the name of the logger folder is not provided, the name of the given sample is used. The sample exists and is not null, as previous checks already ensured that
if (Config.LoggerFolder == null)
{
SetLoggerFolderName();
}
#endregion
#region Optional value checks
//If the entry point should be overridden
if (Config.OverrideEntryPoint == true)
{
//The fully qualified class name needs to be present
if (Config.DllFullyQualifiedClassName == null)
{
throw new Exception("The default entry point is to be overridden, but the fully qualified class name that is to be used, is null!");
}
//As well as the function name
if (Config.DllFunctionName == null)
{
throw new Exception("The default entry point is to be overridden, but the function name that is to be used, is null!");
}
//Arguments are optional, and can also be used for an entry point, which is why they are outside this if-block
}
//If the index and count are not equal to their initial value of -1, it means that they were both provided
if (PayloadArgumentsIndex > 0 && PayloadArgumentCount > 0)
{
//Given that they are both provided, they need to be handled
SetDllArguments(args, PayloadArgumentsIndex, PayloadArgumentCount);
}
else //In case one or both of these values is still equal to -1
{
//If the payload count is missing, an error is thrown
if (PayloadArgumentCount > 0)
{
throw new Exception("No argument count was found, even though arguments were specified!");
}
else if (PayloadArgumentsIndex > 0) //If the payload count is more than zero, it means that the index is missing, for which an error needs to be thrown
{
throw new Exception("No arguments were found, even though an argument count was specified!");
}
}
#endregion
}
catch (Exception ex) //Any thrown exception is caught, printed to the standard output, after which DotDumper waits for any key to exit
{
Console.WriteLine("[ERROR] " + ex.Message + "\n\nPress any key to exit...");
Console.ReadKey();
Environment.Exit(0);
}
}
/// <summary>
/// Sets the logger folder name to the given file name, appending "_DotDumper" to it until the folder does not exist
/// </summary>
private static void SetLoggerFolderName()
{
string loggerFolder = Path.GetFileNameWithoutExtension(Config.SamplePath);
while (true)
{
if (Directory.Exists(loggerFolder) == false && File.Exists(loggerFolder) == false)
{
break;
}
else
{
loggerFolder += "_DotDumper";
}
}
Config.LoggerFolder = loggerFolder;
}
/// <summary>
/// Tries to fetch the next index from the array, based on the provided array and index
/// </summary>
/// <param name="args">The array to use</param>
/// <param name="index">The index to check if there is a next element</param>
/// <returns>True if a next element exists, false if not</returns>
private static bool NextIndexExists(string[] args, int index)
{
try
{
string element = args[index + 1];
return true;
}
catch (Exception)
{
return false;
}
}
/// <summary>
/// Sets the DllArguments field in the config, based on the provided parameters.
/// </summary>
/// <param name="args">The complete set of parameters that DotDumper received</param>
/// <param name="payloadArgumentsIndex">The index at which the first argument is found</param>
/// <param name="payloadArgumentCount">The amount of arguments that are provided by the user</param>
private static void SetDllArguments(string[] args, int payloadArgumentsIndex, int payloadArgumentCount)
{
//The object array that will contain all arguments
object[] dllArgs = new object[payloadArgumentCount];
//The string array that contains the split array for each of the provided types
string[] arrayValues;
//Iterate as many times as there are arguments
for (int i = 0; i < payloadArgumentCount; i++)
{
//Get the index to fetch data from the args array
int index = payloadArgumentsIndex + i;
//Get and split the data
string[] splitted = args[index].Split('|');
//If there are more or less than two fields, something is wrong, thus an error is thrown
if (splitted.Length != 2)
{
throw new Exception("The provided type-value combination is invalid: \"" + args[index] + "\"!");
}
//Get the type from the array, as a lowercase string (so a typo wont influence the outcome here)
string type = splitted[0].ToLowerInvariant();
//Get the value of the given argument
string value = splitted[1];
//Handle any type of supported variables
switch (type)
{
case "bool":
dllArgs[i] = Convert.ToBoolean(value);
break;
case "bool[]":
arrayValues = HandleArray(value);
bool[] bools = new bool[arrayValues.Length];
for (int count = 0; count < arrayValues.Length; count++)
{
bools[count] = Convert.ToBoolean(arrayValues[count]);
}
dllArgs[i] = bools;
break;
case "byte":
dllArgs[i] = Convert.ToByte(value);
break;
case "byte[]":
arrayValues = HandleArray(value);
byte[] bytes = new byte[arrayValues.Length];
for (int count = 0; count < arrayValues.Length; count++)
{
bytes[count] = Convert.ToByte(arrayValues[count]);
}
dllArgs[i] = bytes;
break;
case "sbyte":
dllArgs[i] = Convert.ToSByte(value);
break;
case "sbyte[]":
arrayValues = HandleArray(value);
sbyte[] sbytes = new sbyte[arrayValues.Length];
for (int count = 0; count < arrayValues.Length; count++)
{
sbytes[count] = Convert.ToSByte(arrayValues[count]);
}
dllArgs[i] = sbytes;
break;
case "char":
dllArgs[i] = Convert.ToChar(value);
break;
case "char[]":
arrayValues = HandleArray(value);
char[] chars = new char[arrayValues.Length];
for (int count = 0; count < arrayValues.Length; count++)
{
chars[count] = Convert.ToChar(arrayValues[count]);
}
dllArgs[i] = chars;
break;
case "decimal":
dllArgs[i] = Convert.ToDecimal(value);
break;
case "decimal[]":
arrayValues = HandleArray(value);
decimal[] decimals = new decimal[arrayValues.Length];
for (int count = 0; count < arrayValues.Length; count++)
{
decimals[count] = Convert.ToDecimal(arrayValues[count]);
}
dllArgs[i] = decimals;
break;
case "double":
dllArgs[i] = Convert.ToDouble(value);
break;
case "double[]":
arrayValues = HandleArray(value);
double[] doubles = new double[arrayValues.Length];
for (int count = 0; count < arrayValues.Length; count++)
{
doubles[count] = Convert.ToDouble(arrayValues[count]);
}
dllArgs[i] = doubles;
break;
case "float":
dllArgs[i] = Convert.ToSingle(value);
break;
case "float[]":
arrayValues = HandleArray(value);
float[] floats = new float[arrayValues.Length];
for (int count = 0; count < arrayValues.Length; count++)
{
floats[count] = Convert.ToSingle(arrayValues[count]);
}
dllArgs[i] = floats;
break;
case "int":
dllArgs[i] = Convert.ToInt32(value);
break;
case "int[]":
arrayValues = HandleArray(value);
int[] integers = new int[arrayValues.Length];
for (int count = 0; count < arrayValues.Length; count++)
{
integers[count] = Convert.ToInt32(arrayValues[count]);
}
dllArgs[i] = integers;
break;
case "uint":
dllArgs[i] = Convert.ToUInt32(value);
break;
case "uint[]":
arrayValues = HandleArray(value);
uint[] unsignedIntegers = new uint[arrayValues.Length];
for (int count = 0; count < arrayValues.Length; count++)
{
unsignedIntegers[count] = Convert.ToUInt32(arrayValues[count]);
}
dllArgs[i] = unsignedIntegers;
break;
case "long":
dllArgs[i] = Convert.ToInt64(value);
break;
case "long[]":
arrayValues = HandleArray(value);
long[] longs = new long[arrayValues.Length];
for (int count = 0; count < arrayValues.Length; count++)
{
longs[count] = Convert.ToInt64(arrayValues[count]);
}
dllArgs[i] = longs;
break;
case "ulong":
dllArgs[i] = Convert.ToUInt64(value);
break;
case "ulong[]":
arrayValues = HandleArray(value);
ulong[] unsignedLongs = new ulong[arrayValues.Length];
for (int count = 0; count < arrayValues.Length; count++)
{
unsignedLongs[count] = Convert.ToUInt64(arrayValues[count]);
}
dllArgs[i] = unsignedLongs;
break;
case "short":
dllArgs[i] = Convert.ToInt16(value);
break;
case "short[]":
arrayValues = HandleArray(value);
short[] shorts = new short[arrayValues.Length];
for (int count = 0; count < arrayValues.Length; count++)
{
shorts[count] = Convert.ToInt16(arrayValues[count]);
}
dllArgs[i] = shorts;
break;
case "ushort":
dllArgs[i] = Convert.ToUInt16(value);
break;
case "ushort[]":
arrayValues = HandleArray(value);
ushort[] unsignedShorts = new ushort[arrayValues.Length];
for (int count = 0; count < arrayValues.Length; count++)
{
unsignedShorts[count] = Convert.ToUInt16(arrayValues[count]);
}
dllArgs[i] = unsignedShorts;
break;
case "string":
dllArgs[i] = value;
break;
case "string[]":
dllArgs[i] = HandleArray(value);
break;
case "null":
dllArgs[i] = null;
break;
default:
throw new Exception("The given type is not supported: \"" + type + "\"");
}
}
//Once all arguments have been parsed without errors, the field in the Config class is set, and the function returns
Config.DllArguments = dllArgs;
}
/// <summary>
/// A helper function to split an array. This function is created to be able to quickly replace the split value if need be
/// </summary>
/// <param name="value">The value to split, using a comma as the splitter</param>
/// <returns>The split string as a string array</returns>
private static string[] HandleArray(string value)
{
return value.Split(',');
}
/// <summary>
/// A helper function to check if two given strings are equal, regardless of the used casing in either string
/// </summary>
/// <param name="string1">The first string to compare</param>
/// <param name="string2">The second string to compare</param>
/// <returns>True if the strings are equal (regardless of the used casing), false if not</returns>
private static bool IsEqual(string string1, string string2)
{
if (string1.Equals(string2, StringComparison.InvariantCultureIgnoreCase))
{
return true;
}
return false;
}
}
}
================================================
FILE: DotDumper/Config.cs
================================================
namespace DotDumper
{
/// <summary>
/// This class contains the default configuration values. Fields are overwritten with user-provided arguments if present.
/// </summary>
class Config
{
/// <summary>
/// The complete path to the sample that is to be executed. The default value is null.
/// </summary>
public static string SamplePath = null;
/// <summary>
/// The name of the folder that is to be used to place all artifacts in. This folder always resides within DotDumper.exe's folder. The default value is null.
/// </summary>
public static string LoggerFolder = null;
/// <summary>
/// True if deprecated functions should also be hooked (when a hook is present for such a function that is), false if not. The default value is true.
/// </summary>
public static bool IncludeDeprecatedFunctions = true;
/// <summary>
/// True if the hooks should be printed in string form during DotDumper's startup, false if not. The default value is true.
/// </summary>
public static bool LogHooks = true;
/// <summary>
/// The amount of milliseconds that the timer waits before calling the callback function for the rehook. The default value is 20.
/// </summary>
public static int RaceConditionDueTime = 20;
/// <summary>
/// Defines if the entry point (if present) should be overriden. A sample without an entrypoint should still be overridden! The default value is false.
/// </summary>
public static bool OverrideEntryPoint = false;
/// <summary>
/// The fully qualified class name, including the namespace(s). The default value is null.
/// </summary>
public static string DllFullyQualifiedClassName = null;
/// <summary>
/// The name of the public function in the given fully qualified class name. The default value is null.
/// </summary>
public static string DllFunctionName = null;
/// <summary>
/// The provided arguments for the given function (or the entry point). The default value is null.
/// </summary>
public static object[] DllArguments = null;
/// <summary>
/// True if calls to Thread.Sleep should be skipped, false if not. The default value is true.
/// </summary>
public static bool SleepSkip = true;
/// <summary>
/// True if the logs should be printed to the console, false if not. The default value is true.
/// </summary>
public static bool PrintLogsToConsole = true;
}
}
================================================
FILE: DotDumper/DotDumper.csproj
================================================
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{97B3A6FF-A6EC-488A-8206-9820DC1F109B}</ProjectGuid>
<OutputType>Exe</OutputType>
<RootNamespace>DotDumper</RootNamespace>
<AssemblyName>DotDumper</AssemblyName>
<TargetFrameworkVersion>v4.8</TargetFrameworkVersion>
<FileAlignment>512</FileAlignment>
<AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects>
<Deterministic>true</Deterministic>
<TargetFrameworkProfile />
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>bin\Debug\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugType>pdbonly</DebugType>
<Optimize>true</Optimize>
<OutputPath>bin\Release\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Debug|x64'">
<DebugSymbols>true</DebugSymbols>
<OutputPath>bin\x64\Debug\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<DebugType>full</DebugType>
<PlatformTarget>x64</PlatformTarget>
<ErrorReport>prompt</ErrorReport>
<CodeAnalysisRuleSet>MinimumRecommendedRules.ruleset</CodeAnalysisRuleSet>
<Prefer32Bit>true</Prefer32Bit>
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Release|x64'">
<OutputPath>bin\x64\Release\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<Optimize>true</Optimize>
<DebugType>pdbonly</DebugType>
<PlatformTarget>x64</PlatformTarget>
<ErrorReport>prompt</ErrorReport>
<CodeAnalysisRuleSet>MinimumRecommendedRules.ruleset</CodeAnalysisRuleSet>
<Prefer32Bit>true</Prefer32Bit>
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
</PropertyGroup>
<PropertyGroup>
<ApplicationIcon>DotDumper.ico</ApplicationIcon>
</PropertyGroup>
<ItemGroup>
<Reference Include="Microsoft.VisualBasic" />
<Reference Include="PeNet, Version=2.9.9.0, Culture=neutral, PublicKeyToken=6cf2bfba59bcfb3f, processorArchitecture=MSIL">
<HintPath>..\packages\PeNet.2.9.9\lib\net48\PeNet.dll</HintPath>
</Reference>
<Reference Include="PeNet.Asn1, Version=2.0.0.0, Culture=neutral, PublicKeyToken=1e2e3568f0050bf5, processorArchitecture=MSIL">
<HintPath>..\packages\PeNet.Asn1.2.0.0\lib\net48\PeNet.Asn1.dll</HintPath>
</Reference>
<Reference Include="System" />
<Reference Include="System.Buffers, Version=4.0.3.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51, processorArchitecture=MSIL">
<HintPath>..\packages\System.Buffers.4.5.1\lib\net461\System.Buffers.dll</HintPath>
</Reference>
<Reference Include="System.Core" />
<Reference Include="System.Diagnostics.Process, Version=4.1.1.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
<HintPath>..\packages\System.Diagnostics.Process.4.3.0\lib\net461\System.Diagnostics.Process.dll</HintPath>
<Private>True</Private>
<Private>True</Private>
</Reference>
<Reference Include="System.Drawing" />
<Reference Include="System.Memory, Version=4.0.1.2, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51, processorArchitecture=MSIL">
<HintPath>..\packages\System.Memory.4.5.5\lib\net461\System.Memory.dll</HintPath>
</Reference>
<Reference Include="System.Numerics" />
<Reference Include="System.Numerics.Vectors, Version=4.1.4.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
<HintPath>..\packages\System.Numerics.Vectors.4.5.0\lib\net46\System.Numerics.Vectors.dll</HintPath>
</Reference>
<Reference Include="System.Runtime.CompilerServices.Unsafe, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
<HintPath>..\packages\System.Runtime.CompilerServices.Unsafe.6.0.0\lib\net461\System.Runtime.CompilerServices.Unsafe.dll</HintPath>
</Reference>
<Reference Include="System.Security" />
<Reference Include="System.Security.Cryptography.Pkcs, Version=6.0.0.1, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
<HintPath>..\packages\System.Security.Cryptography.Pkcs.6.0.1\lib\net461\System.Security.Cryptography.Pkcs.dll</HintPath>
</Reference>
<Reference Include="System.Web.Extensions" />
<Reference Include="System.Xml.Linq" />
<Reference Include="System.Data.DataSetExtensions" />
<Reference Include="Microsoft.CSharp" />
<Reference Include="System.Data" />
<Reference Include="System.Net.Http" />
<Reference Include="System.Xml" />
</ItemGroup>
<ItemGroup>
<Compile Include="ArgumentHandler.cs" />
<Compile Include="Config.cs" />
<Compile Include="Helpers\ArgumentHelper.cs" />
<Compile Include="Helpers\AssemblyMapper.cs" />
<Compile Include="Helpers\LogEntryHelper.cs" />
<Compile Include="Helpers\Serialise.cs" />
<Compile Include="Helpers\MissedAssemblyDumper.cs" />
<Compile Include="Helpers\StagnationHandler.cs" />
<Compile Include="HookHandlers\Activator\ActivatorHooks.cs" />
<Compile Include="HookHandlers\Assembly\AssemblyHooks.cs" />
<Compile Include="HookHandlers\Console\ConsoleHooks.cs" />
<Compile Include="HookHandlers\Convert\ConvertHooks.cs" />
<Compile Include="HookHandlers\Directory\DirectoryHooks.cs" />
<Compile Include="HookHandlers\Environment\EnvironmentHooks.cs" />
<Compile Include="HookHandlers\File\FileHooks.cs" />
<Compile Include="HookHandlers\MethodBase\MethodBaseHooks.cs" />
<Compile Include="HookHandlers\Path\PathHooks.cs" />
<Compile Include="HookHandlers\Process\ProcessHooks.cs" />
<Compile Include="HookHandlers\ResourceManager\ResourceManagerHooks.cs" />
<Compile Include="HookHandlers\Thread\ThreadHooks.cs" />
<Compile Include="HookHandlers\Type\TypeHooks.cs" />
<Compile Include="HookHandlers\Type\TypeHooksHelper.cs" />
<Compile Include="Hooks\Hook.cs" />
<Compile Include="Helpers\Hashes.cs" />
<Compile Include="HookHandlers\GenericHookHelper.cs" />
<Compile Include="Hooks\HookManager.cs" />
<Compile Include="Hooks\InteropFunctions.cs" />
<Compile Include="Hooks\OriginalManagedFunctions.cs" />
<Compile Include="Hooks\OriginalUnmanagedFunctions.cs" />
<Compile Include="Logger.cs" />
<Compile Include="Models\Argument.cs" />
<Compile Include="Models\AssemblyObject.cs" />
<Compile Include="Models\Hash.cs" />
<Compile Include="Models\LogEntry.cs" />
<Compile Include="Models\UnmanagedMethodInfo.cs" />
<Compile Include="Pipes\PipeManager.cs" />
<Compile Include="Program.cs" />
<Compile Include="Properties\AssemblyInfo.cs" />
<Compile Include="Helpers\RaceConditionHandler.cs" />
</ItemGroup>
<ItemGroup>
<None Include="app.config" />
<None Include="packages.config" />
</ItemGroup>
<ItemGroup>
<Content Include="DotDumper.ico" />
</ItemGroup>
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
</Project>
================================================
FILE: DotDumper/Helpers/ArgumentHelper.cs
================================================
using System;
using System.Collections;
using System.Collections.Generic;
using System.Linq;
using System.Reflection;
using DotDumper.HookHandlers;
using DotDumper.Models;
namespace DotDumper.Helpers
{
/// <summary>
/// This class is used to save and handle arguments from functions
/// </summary>
class ArgumentHelper
{
/// <summary>
/// Verifies if a given hash object occurs in the given list of hashes. Existance of the same hash is based on the included SHA-256 hash in the hash object, regardless of the casing. As such, two different objects based on the same file will be seen as duplicates in the same way as the same object will be seen as a duplicate when it is provided as an argument whilst also being in the list.
/// </summary>
/// <param name="hashes">The list of hashes, which will be used to check if the given hash is present in this list</param>
/// <param name="hash">The hash to check if it is present in the given list</param>
/// <returns>True if the list contains the hash, false if not</returns>
public static bool ContainsHash(List<Hash> hashes, Hash hash)
{
//Iterate over all given hashes
foreach (Hash currentHash in hashes)
{
//If the currently iterated hash equals the given hash, regardless of the casing
if (currentHash.Sha256.Equals(hash.Sha256, StringComparison.InvariantCultureIgnoreCase))
{
//Return true
return true;
}
}
//If no matches were found while the iteration completed, return false
return false;
}
/// <summary>
/// This function saves the value of the given object. The way it is saved depends on the type and the size of the given object. Anything larger than 100 bytes is written to disk. Values are represented in textual form when possible, but some types (i.e. an Assembly object) is always saved to disk, regardless of its size.
/// </summary>
/// <param name="input">The object to save</param>
/// <returns>A tuple with a string (the textual representation of the given input, which can be a reference to a file), and a list of hashes (which can be empty) for all files that were saved to the disk. This list can be empty, but will never be null</returns>
public static Tuple<string, List<Hash>> SaveValue(object input)
{
List<Hash> relatedFileHashes = new List<Hash>();
string value = "";
if (input is bool
|| input is byte
|| input is sbyte
|| input is char
|| input is decimal
|| input is double
|| input is float
|| input is int
|| input is uint
|| input is long
|| input is ulong
|| input is short
|| input is ushort
|| input is string)
{
if (input.ToString().Length > 100)
{
//Save the file
Tuple<string, Hash> result = GenericHookHelper.SaveFile(input.ToString());
if (ContainsHash(relatedFileHashes, result.Item2) == false)
{
relatedFileHashes.Add(result.Item2);
}
value += "";
}
else
{
value += input;
}
}
else if (input is Assembly)
{
Assembly assembly = (Assembly)input;
byte[] rawAssembly = GenericHookHelper.GetAsByteArray(assembly);
//Save the file, which returns the path to the file, where the file name is the SHA-256 hash of the given content
Tuple<string, Hash> result = GenericHookHelper.SaveFile(rawAssembly);
if (ContainsHash(relatedFileHashes, result.Item2) == false)
{
relatedFileHashes.Add(result.Item2);
}
if (MissedAssemblyDumper.AssemblyHashes.Contains(result.Item2.Sha256) == false)
{
MissedAssemblyDumper.AssemblyHashes.Add(result.Item2.Sha256);
}
value = "";
}
else if (input is IList)
{
Tuple<string, List<Hash>> result = HandleCollection(input);
value = result.Item1;
foreach (Hash hash in result.Item2)
{
if (ContainsHash(relatedFileHashes, hash) == false)
{
relatedFileHashes.Add(hash);
}
}
}
else if (input == null)
{
value = "null";
}
else
{
value = input.ToString();
}
return Tuple.Create(value, relatedFileHashes);
}
/// <summary>
/// Creats an argument object, based on the given input and the name of the argument
/// </summary>
/// <param name="input">The value of the argument, of which the type is derrived</param>
/// <param name="argumentName">The name of the argument</param>
/// <returns>An argument object that corresponds with the given arguments</returns>
public static Argument Create(object input, string argumentName)
{
Tuple<string, List<Hash>> result = SaveValue(input);
string argType = "null";
string argValue = "null";
if (input != null)
{
argType = input.GetType().FullName;
}
if (result.Item1 != null)
{
argValue = result.Item1;
}
return new Argument(argType, argumentName, argValue, result.Item2);
}
/// <summary>
/// Creates a list of argument objects based on the given method, along with their values
/// </summary>
/// <param name="method">The method to fetch the arguments from</param>
/// <param name="parameterValues">The values of the parameters (in order of the method's parameters)</param>
/// <returns>A list of argument objects based on the two given arguments</returns>
public static List<Argument> Create(MethodBase method, object[] parameterValues)
{
List<Argument> arguments = new List<Argument>();
if (method != null && parameterValues != null)
{
ParameterInfo[] parameterInfos = method.GetParameters();
for (int i = 0; i < parameterInfos.Length; i++)
{
object parameter;
if (parameterValues.Length <= i)
{
parameter = null;
}
else
{
parameter = parameterValues[i];
}
string type = "null";
string name = "null";
if (parameterInfos[i] != null)
{
type = parameterInfos[i].ParameterType.FullName;
name = parameterInfos[i].Name;
}
Tuple<string, List<Hash>> result = SaveValue(parameter);
string value = "null";
if (result.Item1 != null)
{
value = result.Item1;
}
Argument argument = new Argument(type, name, value, result.Item2);
arguments.Add(argument);
}
}
return arguments;
}
/// <summary>
/// Handles a collection, either by converting it into a string, or by saving it to the disk and returning the location as if it were the value, together with a brief explanation).
/// </summary>
/// <param name="collection">The collection to handle</param>
/// <returns>The handled collection in the form of a string (as Item1 in the tuple), as well as a list of file hashes of related files (if any, as Item2 in the tuple)</returns>
private static Tuple<string, List<Hash>> HandleCollection(object collection)
{
//Initialise the list of related files
List<Hash> files = new List<Hash>();
//Initialise the data variable
string data = "";
//Any type of collection with a length of more than 100 indices is saved to disk, as converting and printing large arrays can consume a lot of time
if (((IList)collection).Count > 100)
{
//Save the file, which returns a tuple with the path to the file, and a hash object with the MD-5, SHA-1, and SHA-256 hash of the file, where the file name is the SHA-256 hash of the given content
Tuple<string, Hash> result = GenericHookHelper.SaveFile((byte[])collection);
//Add it to the list of files
if (ContainsHash(files, result.Item2) == false)
{
files.Add(result.Item2);
}
//Inform the user that the data is stored in a file
data += "DotDumper::" + result.Item2.Sha256 + " "; //Note: the last two characters are removed once the function returns
}
else //Handle collections that are less than 100 indices in size
{
//If the type is an object collection, it needs to be handled in a specific way
if (collection is object[] || collection is IList<object>)
{
if (collection is IList<object>)
{
collection = ((IList<object>)collection).ToArray();
}
if (((object[])collection).Length == 0)
{
data += "DotDumper::empty "; //Note: the last two characters are removed once the function returns
}
else
{
foreach (object subParameter in (object[])collection)
{
if (subParameter is object[] || subParameter is IList<object>)
{
//Recursive call if the array contains an array
Tuple<string, List<Hash>> result = HandleCollection(subParameter);
//Get the data from the tuple, and append it to this one
data += result.Item1;
//Add all file hashes to the current file list
foreach (Hash hash in result.Item2)
{
if (ContainsHash(files, hash) == false)
{
files.Add(hash);
}
}
}
else if (subParameter == null)
{
data += "null";
}
else
{
string subParameterType = subParameter.GetType().FullName;
data += subParameterType + " " + subParameter;
}
data += ", ";
}
}
}
else
{
foreach (var subParameter in (IList)collection)
{
if (subParameter == null)
{
data += "null";
}
else
{
data += subParameter;
}
data += ", ";
}
}
}
//Remove the last comma and space, after which a curly bracket is appended
data = data.Substring(0, data.Length - 2);
//Return the value as a tuple
return Tuple.Create(data, files);
}
}
}
================================================
FILE: DotDumper/Helpers/AssemblyMapper.cs
================================================
using System;
using System.Collections.Generic;
using System.Reflection;
using DotDumper.HookHandlers;
using DotDumper.Hooks;
using DotDumper.Models;
namespace DotDumper.Helpers
{
/// <summary>
/// This class is used to map a (line of a) stack trace to an assembly object
/// </summary>
class AssemblyMapper
{
/// <summary>
/// Gets the function's signature as a string, formatted as "Full.Class.Path.With.Function(ArgumentType argumentName)". An example is "System.Reflection.Assembly.Load(Byte[] rawAssembly)".
/// </summary>
/// <returns>The hook's full name as a string, i.e. "System.Reflection.Assembly.Load(Byte[] rawAssembly)"</returns>
private static string GetMethod(MethodInfo method)
{
string output = method.DeclaringType + "." + method.Name + "(";
foreach (ParameterInfo parameterInfo in method.GetParameters())
{
output += parameterInfo.ParameterType.Name + " " + parameterInfo.Name + ", ";
}
if (method.GetParameters().Length > 0)
{
output = output.Substring(0, output.Length - 2);
}
output += ")";
return output;
}
/// <summary>
/// Creates the mapping as a dictionary where the keys equal a function signature as a string, and an assembly object as the value. Hooks are set prior to returning from this function!
/// </summary>
/// <returns>The mapping to use when matching a (line of a) stack trace</returns>
public static Dictionary<string, Assembly> CreateMapping()
{
HookManager.UnHookAll();
Dictionary<string, Assembly> mapping = new Dictionary<string, Assembly>();
Assembly[] assemblies = AppDomain.CurrentDomain.GetAssemblies();
foreach (Assembly assembly in assemblies)
{
//Omit framework related objects, as well as DotDumper itself
if (assembly.GlobalAssemblyCache ||
assembly.GetName().FullName.ToLowerInvariant().Contains("dotdumper"))
{
continue;
}
Type[] types = assembly.GetTypes();
foreach (Type type in types)
{
//Gets all declared (omitting inherited functions to avoid duplicates) public, non-public, normal, and static functions
MethodInfo[] methodInfos = type.GetMethods(BindingFlags.DeclaredOnly | BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Static | BindingFlags.Instance);
foreach (MethodInfo methodInfo in methodInfos)
{
if (methodInfo.DeclaringType.Assembly == assembly)
{
string functionSignature = GetMethod(methodInfo);
if (mapping.ContainsKey(functionSignature) == false)
{
mapping.Add(functionSignature, assembly);
}
}
}
}
}
HookManager.HookAll();
return mapping;
}
/// <summary>
/// Get the assembly object where the referenced function of the stack trace line resides. If it is not found, null is returned!
/// </summary>
/// <param name="stackTraceLine">The raw stack trace line to match</param>
/// <returns>The assembly object if it can be found, null if it cannot be found</returns>
public static Assembly ProcessStackTraceLine(string stackTraceLine)
{
//Create the mapping, ensuring it is as up to date as possible
Dictionary<string, Assembly> mapping = CreateMapping();
//Remove leading and trailing whitespace
stackTraceLine = stackTraceLine.Trim();
//Skip "at " from the line in the beginning
stackTraceLine = stackTraceLine.Substring(3);
//Declare the corresponding Assembly object
Assembly assembly = null;
//Get the Assembly object from the mapping, which returns null if it is not present
mapping.TryGetValue(stackTraceLine, out assembly);
//Return the Assembly object (or null, if it couldn't be found)
return assembly;
}
/// <summary>
/// Process a list of stack traces to get a list of assembly objects (concatenated as a string in their simple form) that are used, in the same order, excluding duplicates. A duplicate is when two stack trace lines originate from the same assembly object.
/// </summary>
/// <param name="stackTraceLines">The stack trace lines to use</param>
/// <returns>A string representation of the linked assembly objects, excluding duplicates, in the same order as the given list</returns>
public static string ProcessStackTraceOld(List<string> stackTraceLines)
{
string output = "";
string lastItem = "";
foreach (string stackTraceLine in stackTraceLines)
{
Assembly assembly = ProcessStackTraceLine(stackTraceLine);
string currentItem;
if (assembly != null)
{
currentItem = assembly.FullName;
}
else
{
currentItem = "[DotDumper or DotNet Framework related assembly]";
}
if (currentItem.Equals(lastItem, StringComparison.InvariantCultureIgnoreCase) == false)
{
output += currentItem + "\n";
lastItem = currentItem;
}
}
return output;
}
/// <summary>
/// Process a list of stack traces to get a list of assembly objects (concatenated as a string in their simple form) that are used, in the same order, excluding duplicates. A duplicate is when two stack trace lines originate from the same assembly object.
/// </summary>
/// <param name="stackTraceLines">The stack trace lines to use</param>
/// <returns>A string representation of the linked assembly objects, excluding duplicates, in the same order as the given list</returns>
public static Tuple<Assembly, List<AssemblyObject>> ProcessStackTrace(List<string> stackTraceLines)
{
List<AssemblyObject> assemblyObjects = new List<AssemblyObject>();
Assembly originatingAssembly = null;
foreach (string stackTraceLine in stackTraceLines)
{
Assembly assembly = ProcessStackTraceLine(stackTraceLine);
//Default values, if the assembly is part of the GAC or if it refers to DotDumper
string name = "[DotDumper or DotNet Framework related assembly]";
string hash = "[none]";
//If the response from the function is not null, an object matches
if (assembly != null)
{
//Set the hash and the name for the given assembly object
hash = Hashes.Sha256(GenericHookHelper.GetAsByteArray(assembly));
name = assembly.GetName().Name;
//Set the originating assembly as the first non-GAC non-DotDumper assembly
if (originatingAssembly == null)
{
originatingAssembly = assembly;
}
}
//Check if this object is not the same as the last in the list
if (assemblyObjects.Count == 0)
{
AssemblyObject assemblyObject = new AssemblyObject(hash, name);
assemblyObjects.Add(assemblyObject);
}
else
{
if (assemblyObjects[assemblyObjects.Count - 1].Hash.Equals(hash, StringComparison.InvariantCultureIgnoreCase) == false)
{
AssemblyObject assemblyObject = new AssemblyObject(hash, name);
assemblyObjects.Add(assemblyObject);
}
}
}
return Tuple.Create(originatingAssembly, assemblyObjects);
}
/// <summary>
/// Checks if a the most recent call of a given list of strack trace lines is coming from a stage of a sample, or from DotDumper, or a GAC module
/// </summary>
/// <param name="stackTraceLines">The stack trace to use</param>
/// <returns>True if the most recent call is coming from a sample stage, false if it is coming from DotDumper, or a GAC module</returns>
public static bool IsComingFromSample(List<string> stackTraceLines)
{
/*
* Get the last call from the trace, as this is the origin of the hook location. Use the last call from the trace to check if it matches any key in the mapping
*/
Assembly assembly = ProcessStackTraceLine(stackTraceLines[0]);
if (assembly == null)
{
//Null means it didn't match a binary, since it is part of the framework's core, or DotDumper internally
return false;
}
{
//Not null means it matched with one of the binaries
return true;
}
}
}
}
================================================
FILE: DotDumper/Helpers/Hashes.cs
================================================
using System.Linq;
using System.Security.Cryptography;
using DotDumper.Hooks;
using PeNet;
namespace DotDumper.Helpers
{
/// <summary>
/// This class contains functions to hash a byte array, after which the hash is returned as a string
/// </summary>
class Hashes
{
/// <summary>
/// Calculates the MD-5 hash of the given byte array
/// </summary>
/// <param name="data">The data to hash</param>
/// <returns>The MD-5 hash as a string</returns>
public static string Md5(byte[] data)
{
MD5 md5 = MD5.Create();
return CalculateHash(md5, data);
}
/// <summary>
/// Calculates the SHA-1 hash of the given byte array
/// </summary>
/// <param name="data">The data to hash</param>
/// <returns>The SHA-1 hash as a string</returns>
public static string Sha1(byte[] data)
{
SHA1 sha1 = SHA1.Create();
return CalculateHash(sha1, data);
}
/// <summary>
/// Calculates the SHA-256 hash of the given byte array
/// </summary>
/// <param name="data">The data to hash</param>
/// <returns>The SHA-256 hash as a string</returns>
public static string Sha256(byte[] data)
{
SHA256 sha256 = SHA256.Create();
return CalculateHash(sha256, data);
}
/// <summary>
/// Calculates the SHA-384 hash of the given byte array
/// </summary>
/// <param name="data">The data to hash</param>
/// <returns>The SHA-384 hash as a string</returns>
public static string Sha384(byte[] data)
{
SHA384 sha384 = SHA384.Create();
return CalculateHash(sha384, data);
}
/// <summary>
/// Calculates the SHA-512 hash of the given byte array
/// </summary>
/// <param name="data">The data to hash</param>
/// <returns>The SHA-512 hash as a string</returns>
public static string Sha512(byte[] data)
{
SHA512 sha512 = SHA512.Create();
return CalculateHash(sha512, data);
}
/// <summary>
/// Calculates the TypeRef hash of the given byte array. Hooks are set prior to returning from this function!
/// </summary>
/// <param name="data">The data to hash</param>
/// <returns>The TypeRef hash as a string, or an empty string in case an error occurs (i.e. the input is not a valid PE file which targets the DotNet Framework)</returns>
public static string TypeRef(byte[] data)
{
HookManager.UnHookAll();
if (PeFile.TryParse(data, out PeFile peFile) == false)
{
return "";
}
if (peFile.IsDotNet == false)
{
return "";
}
string typeRefHash = peFile.TypeRefHash;
if (typeRefHash == null)
{
typeRefHash = "";
}
HookManager.HookAll();
return typeRefHash;
}
/// <summary>
/// Calculates the import hash of the given byte array. Hooks are set prior to returning from this function!
/// </summary>
/// <param name="data">The data to hash</param>
/// <returns>The import hash as a string, or an empty string in case an error occurs (i.e. the input is not a valid PE file)</returns>
public static string ImportHash(byte[] data)
{
HookManager.UnHookAll();
if (PeFile.TryParse(data, out PeFile peFile) == false)
{
return "";
}
string importHash = peFile.ImpHash;
if (importHash == null)
{
importHash = "";
}
HookManager.HookAll();
return importHash;
}
/// <summary>
/// Calculates the authenticode hash (SHA-256 based) of the given byte array. Hooks are set prior to returning from this function!
/// </summary>
/// <param name="data">The data to hash</param>
/// <returns>The authenticode hash (SHA-256 based) as a string, or an empty string in case an error occurs (i.e. the input is not a valid PE)</returns>
public static string AuthenticodeSha256(byte[] data)
{
return Authenticode(data, SHA256.Create());
}
/// <summary>
/// Calculates the authenticode hash (based on the provided hash algorithm) of the given byte array. Hooks are set prior to returning from this function!
/// </summary>
/// <param name="data">The data to hash</param>
/// <param name="hashAlgorithm">The hashing algorithm to use</param>
/// <returns>The authenticode hash (based on the provided hash algorithm), or an empty string in case an error occurs (i.e. the input is not a valid PE file)</returns>
private static string Authenticode(byte[] data, HashAlgorithm hashAlgorithm)
{
HookManager.UnHookAll();
if (PeFile.TryParse(data, out PeFile peFile) == false)
{
return "";
}
string authenticode = peFile.Authenticode.ComputeAuthenticodeHashFromPeFile(hashAlgorithm).ToList().ToHexString();
if (authenticode == null || authenticode.Length < 2)
{
authenticode = authenticode.Substring(2);
}
else
{
authenticode = "";
}
HookManager.HookAll();
return authenticode;
}
/// <summary>
/// This function calculates the hash of the given data, using the given hashing algorithm
/// </summary>
/// <param name="hashAlgorithm">The hashing algorithm to use</param>
/// <param name="data">The data to hash</param>
/// <returns>The hash of the data as a string, based on the given hash algorithm</returns>
private static string CalculateHash(HashAlgorithm hashAlgorithm, byte[] data)
{
string hash = "";
if (data == null || hashAlgorithm == null)
{
return hash;
}
byte[] rawHash = hashAlgorithm.ComputeHash(data);
for (int i = 0; i < rawHash.Length; i++)
{
hash += rawHash[i].ToString("x2");
}
return hash;
}
}
}
================================================
FILE: DotDumper/Helpers/LogEntryHelper.cs
================================================
using System;
using System.Collections.Generic;
using System.Reflection;
using DotDumper.HookHandlers;
using DotDumper.Hooks;
using DotDumper.Models;
namespace DotDumper.Helpers
{
/// <summary>
/// This class is used to create DotDumper.Model.LogEntry objects based on as few parameters as possible
/// </summary>
class LogEntryHelper
{
/// <summary>
/// Creates a log entry object based on the given exception, with the given stack trace offset from the caller's position
/// </summary>
/// <param name="stackTraceOffset">The amount of layers away from the original call flow, based on the caller's position</param>
/// <param name="ex">The exception to base the log entry object on</param>
/// <returns>A log entry based on the given values</returns>
public static LogEntry Create(int stackTraceOffset, Exception ex)
{
stackTraceOffset++;
LogEntry entry = Create(stackTraceOffset, ex.TargetSite, null, ex);
return entry;
}
/// <summary>
/// Creates a log entry for an unmanaged function, along with its argument and return values
/// </summary>
/// <param name="unmanagedMethodInfo">The unmanaged methodinfo object, corresponding to the original function that was hooked</param>
/// <param name="parameterValues">An array of objects with the values of the function's arguments</param>
/// <param name="returnValue">The value of the function's return value</param>
/// <returns>A log entry based on the given values</returns>
public static LogEntry Create(UnmanagedMethodInfo unmanagedMethodInfo, object[] parameterValues, object returnValue)
{
MethodInfo methodInfo = HookManager.GetMethodInfo(typeof(InteropFunctions), unmanagedMethodInfo.MethodName, unmanagedMethodInfo.ParameterTypes);
//A negative value for the stack trace, as the wrong value is obtained since this call is invoked based on async information that is shared via the unmanaged function hooks that share via a named pipe
return Create(-1, methodInfo, parameterValues, returnValue);
}
/// <summary>
/// Creates a log entry based on the given stack trace offset (from the caller's position), method, the method values, and the return value of said method
/// </summary>
/// <param name="stackTraceOffset">The amount of layers away from the original call flow, based on the caller's position. A value less than 0 is used to indicate that the stack trace is to be ignored (done for unmanaged function hooks, as the function is obtained from a different location than the actual call comes from)</param>
/// <param name="method">The method that is of importance to log</param>
/// <param name="parameterValues">The values of said method's parameters</param>
/// <param name="returnValue">The return value of the function (use null if it's a void)</param>
/// <returns>A log entry based on the given values</returns>
public static LogEntry Create(int stackTraceOffset, MethodBase method, object[] parameterValues, object returnValue)
{
//Gets a list of arguments based on the given function
List<Argument> functionArguments = ArgumentHelper.Create(method, parameterValues);
//Initialises a list of related files
List<Hash> relatedFileHashes = new List<Hash>();
//Iterate over all extracted arguments
foreach (Argument argument in functionArguments)
{
//Iterate over all hashes
foreach (Hash hash in argument.RelatedFileHashes)
{
//If there is no such hash in the list, add it. Otherwise, ignore it
if (ArgumentHelper.ContainsHash(relatedFileHashes, hash) == false)
{
relatedFileHashes.Add(hash);
}
}
}
//Declare and initialise the stack trace variable
List<string> stackTrace = new List<string>();
/*
* If the value is negative, its a hook for an unmanaged function and the only obtainable stack trace is useless. If it is zero or higher, its a managed hook
*/
if (stackTraceOffset >= 0)
{
//Increment the stack trace offset, since this is another function deep into the trace
stackTraceOffset++;
//Get the stack trace
stackTrace = GenericHookHelper.GetStackTraceRaw(stackTraceOffset);
}
//Get the assembly and assembly object information based on the stack trace
Tuple<Assembly, List<AssemblyObject>> result = AssemblyMapper.ProcessStackTrace(stackTrace);
//Declare the originating assembly variable
Assembly originatingAssembly = null;
/*
* If the first tuple item (being the Assembly object) is null, the call is coming from either the DotNet Framework, or from DotDumper's code base.
* If the value is not-null, it is assigned.
*/
if (result.Item1 == null)
{
HookManager.UnHookAll();
originatingAssembly = Assembly.GetAssembly(typeof(Program));
HookManager.HookAll();
}
else
{
originatingAssembly = result.Item1;
}
//Get the name from the originating assembly
string originatingAssemblyName = originatingAssembly.GetName().Name;
//Get the raw assembly as an unboxed byte array
byte[] rawAssembly = GenericHookHelper.GetAsByteArray(originatingAssembly);
//Get the hashes based on the given raw assembly byte array
string md5 = Hashes.Md5(rawAssembly);
string sha1 = Hashes.Sha1(rawAssembly);
string sha256 = Hashes.Sha256(rawAssembly);
string sha384 = Hashes.Sha384(rawAssembly);
string sha512 = Hashes.Sha512(rawAssembly);
string typeRef = Hashes.TypeRef(rawAssembly);
string importHash = Hashes.ImportHash(rawAssembly);
string authenticodeSha256 = Hashes.AuthenticodeSha256(rawAssembly);
//Create a hash object to store the values in
Hash originatingAssemblyHash = new Hash(md5, sha1, sha256, sha384, sha512, typeRef, importHash, authenticodeSha256);
//Get the originating assembly version
string originatingAssemblyVersion = originatingAssembly.GetName().Version.ToString();
//Get the originating assembly resource names
List<string> originatingAssemblyResourceNames = new List<string>(originatingAssembly.GetManifestResourceNames());
//Get the call order, which is the second item from the tuple
List<AssemblyObject> assemblyCallOrder = result.Item2;
//Declare and assign a value to the parent assembly hash string
string parentAssemblyHash = "[none]";
//Iterate over all assembly objects in the call order
foreach (AssemblyObject assemblyObject in assemblyCallOrder)
{
//If the hash is not equal to none nor to the current originating hash, it is set as the parent
if (assemblyObject.Hash.Equals("[none]", StringComparison.InvariantCultureIgnoreCase) == false
&& assemblyObject.Hash.Equals(originatingAssemblyHash.Sha256, StringComparison.InvariantCultureIgnoreCase) == false)
{
parentAssemblyHash = assemblyObject.Hash;
//There is no need to continue the iteration, since only the first parent is stored (and the rest is visible in the call order)
break;
}
}
//Get the function name
string functionName = Serialise.Method(method);
//The return value is stored in an argument object, with a hardcoded name
Argument returnValueArg = ArgumentHelper.Create(returnValue, "ReturnValue");
//The return value can also be related to a file
foreach (Hash hash in returnValueArg.RelatedFileHashes)
{
//Iterate over all the hashes, and add the ones that aren't in the list yet
if (ArgumentHelper.ContainsHash(relatedFileHashes, hash) == false)
{
relatedFileHashes.Add(hash);
}
}
//Return a new LogEntry object based on all the gathered information
return new LogEntry(originatingAssemblyName, originatingAssemblyHash, originatingAssemblyVersion, originatingAssemblyResourceNames, parentAssemblyHash, relatedFileHashes, functionName, functionArguments, returnValueArg, stackTrace, assemblyCallOrder);
}
}
}
================================================
FILE: DotDumper/Helpers/MissedAssemblyDumper.cs
================================================
using System;
using System.Collections.Generic;
using System.Reflection;
using DotDumper.HookHandlers;
using DotDumper.Hooks;
using DotDumper.Models;
namespace DotDumper.Helpers
{
/// <summary>
/// This class is used to dump missed assembly objects from memory to the disk
/// </summary>
class MissedAssemblyDumper
{
/// <summary>
/// A list which contains the (partial) names of the assemblies to exclude during periodic dumping
/// </summary>
public static List<string> ExcludedAssemblies { get; set; }
/// <summary>
/// SHA-256 hashes of raw Assembly objects (their byte[] representation) that have been written to the disk during the execution of this run of DotDumper
/// </summary>
public static List<string> AssemblyHashes { get; set; }
/// <summary>
/// The static constructor of the class ensures the class scoped list is always initialised prior to its usage
/// </summary>
static MissedAssemblyDumper()
{
//Initialise the lists
AssemblyHashes = new List<string>();
ExcludedAssemblies = new List<string>();
//Populate the list
ExcludedAssemblies.Add("dotdumper");
ExcludedAssemblies.Add("penet");
ExcludedAssemblies.Add("system.memory");
ExcludedAssemblies.Add("system.runtime.compilerservices.unsafe");
ExcludedAssemblies.Add("system.numerics.vectors");
ExcludedAssemblies.Add("microsoft.generatedcode");
}
/// <summary>
/// Dumps all loaded assemblies that haven't been dumped before and are not part of the Global Assembly Cache (GAC). This function removes all hooks, dumps the missing data, after which all hooks are set again.
/// </summary>
public static void Dump()
{
//Temporarily remove all hooks
HookManager.UnHookAll();
//If the original assembly is not null, it can be added to the list of hashes, this avoids the sample to show up as a "missed" assembly object
if (GenericHookHelper.OriginalAssembly != null)
{
//Get the raw bytes
byte[] sample = GenericHookHelper.GetAsByteArray(GenericHookHelper.OriginalAssembly);
//Unhook all hooks, as these are set after the previous call
HookManager.UnHookAll();
//Get the SHA-256 hash
string sampleSha256 = Hashes.Sha256(sample);
//Check if the list does not contain this item
if (AssemblyHashes.Contains(sampleSha256) == false)
{
//Add the hash to the list
AssemblyHashes.Add(sampleSha256);
}
}
//Declare and initialise the list for the saved assemblies
List<Hash> savedAssemblies = new List<Hash>();
//Get all the assemblies in the current domain
Assembly[] assemblies = AppDomain.CurrentDomain.GetAssemblies();
//Iterate over all assemblies within the current domain
foreach (Assembly assembly in assemblies)
{
//Omit DotDumper itself, as well as used (DotNet Framework related) libraries
if (ExcludeAssembly(assembly))
{
continue;
}
try
{
//Get the raw bytes of the assembly
byte[] rawAssembly = GenericHookHelper.GetAsByteArray(assembly);
//Unhook all hooks, as these are set via the previous call
HookManager.UnHookAll();
//Get the SHA-256 hash of the given assembly object's bytes
string sha256 = Hashes.Sha256(rawAssembly);
//Only save assemblies that haven't been saved before during this run
if (AssemblyHashes.Contains(sha256) == false)
{
//Save the file, and store the SHA-256 hash in the list of processed assembly objects, and store the Hash object in the saved assemblies list
Tuple<string, Hash> result = GenericHookHelper.SaveFile(rawAssembly);
HookManager.UnHookAll();
savedAssemblies.Add(result.Item2);
AssemblyHashes.Add(result.Item2.Sha256);
}
}
catch (Exception)
{
//Ignore errors when trying to save an assembly object in its raw form. In some cases, DotNet Framework related assembly objects cause errors when attempting to save them, i.e. when they are dynamically generated
}
}
//If at least 1 assembly has been saved (and was thus missed), this should be logged
if (savedAssemblies.Count > 0)
{
//Create a nearly empty log entry object with the relevant information
LogEntry entry = new LogEntry(null, null, null, null, null, savedAssemblies, "periodic assembly dumping", null, null, null, null);
//Log the entry to all relevant logs
GenericHookHelper._Logger.Log(entry, false, false);
}
//Set all hooks prior to returning to the caller
HookManager.HookAll();
}
/// <summary>
/// Checks if the given assembly is to be excluded or not. It will be if either of the following is true: the given assembly object is null, the given assembly is part of the global assembly cache, or if the fullname matches (in full or partially) the name of any of the names in the exclusion list.
/// </summary>
/// <param name="assembly">The assembly to check for</param>
/// <returns>True if the assembly is to be excluded, false if not</returns>
private static bool ExcludeAssembly(Assembly assembly)
{
//If the given assembly object is null, it is to be excluded
if (assembly == null)
{
return true;
}
//Excludes the assembly if it's part of the global assembly cache
if (assembly.GlobalAssemblyCache)
{
return true;
}
//Get the assembly name in lower case
string assemblyName = assembly.GetName().FullName.ToLowerInvariant();
//Iterate over all excluded assembly names
foreach (string excludedName in ExcludedAssemblies)
{
//If the current assembly name (in lower case) contains the excluded name (also in lower case), it is to be skipped
if (assemblyName.Contains(excludedName.ToLowerInvariant()))
{
return true;
}
}
//The assembly is not to be skipped if its not meeting any of the skip criteria
return false;
}
}
}
================================================
FILE: DotDumper/Helpers/RaceConditionHandler.cs
================================================
using System.Threading;
using DotDumper.Hooks;
using System;
using System.Collections.Generic;
namespace DotDumper.Helpers
{
/// <summary>
/// This class handles the race condition that allows to rehook invoke related functions during their execution
/// </summary>
class RaceConditionHandler
{
/// <summary>
/// The dictionary that contains all timers (as multiple can be created via multiple threads), where a GUID is the key, and the timer object is the value
/// </summary>
private static readonly Dictionary<string, Timer> timers = new Dictionary<string, Timer>();
/// <summary>
/// This function unhooks the given hook based on its name, after which it waits 20 milliseconds. It then calls the timer callback function, which rehooks the given hook. The timer callback is only called once, after which the Timer object is destroyed.
/// </summary>
/// <param name="hookName">The function to unhook and rehook</param>
public static void StartTimer(string hookName)
{
//Create a string with the GUID and the hook name, split by a pipe
string data = hookName + "|" + Guid.NewGuid().ToString();
//Unhook the hook
HookManager.UnHookByHookName(hookName);
//Create a timer object which calls the callback function once, after a 20 ms delay, using the data string as an argument
Timer timer = new Timer(TimerCallback, data, Config.RaceConditionDueTime, Timeout.Infinite); //Timeout.Infinite (aka -1) means no repeated calls, see https://docs.microsoft.com/en-us/dotnet/api/system.threading.timeout.infinite
//Add the timer to the dictionary
timers.Add(data, timer);
}
/// <summary>
/// The callback function for the timer that rehooks the unhooked function
/// </summary>
/// <param name="o">The function argument has to be an argument, but it is actually a string array in this case. The format should be "my-guid|hookName"</param>
private static void TimerCallback(object o)
{
//Split the string into the GUID and function name respectively
string[] array = ((string)o).Split('|');
//Set the hook again
HookManager.HookByHookName(array[0]);
//Get the GUID
string guid = array[1];
//Remove the GUID from the dictionary
timers.Remove(guid);
}
}
}
================================================
FILE: DotDumper/Helpers/Serialise.cs
================================================
using System.IO;
using System.Reflection;
using System.Web.Script.Serialization;
using System.Xml.Serialization;
using DotDumper.Hooks;
namespace DotDumper.Helpers
{
/// <summary>
/// This class is used to convert a given object to JSON using the built-in JavaScriptSerializer object
/// </summary>
class Serialise
{
/// <summary>
/// Converts the given object into its JSON equivalent
/// </summary>
/// <param name="input">The object to obtain the JSON equivalent from</param>
/// <returns>The JSON equivalent of the given object</returns>
public static string ToJson(object input)
{
//If the input is null, return null in string format
if (input == null)
{
return "null";
}
//Remove all hooks
HookManager.UnHookAll();
//Initialise a serialiser object
JavaScriptSerializer serialiser = new JavaScriptSerializer();
//Serialise the input
string result = serialiser.Serialize(input);
//Restore all hooks
HookManager.HookAll();
//Return the result
return result;
}
/// <summary>
/// Converts the given object into its XML equivalent
/// </summary>
/// <param name="input">The object to obtain the XML equivalent from</param>
/// <returns>The XML equivalent of the given object</returns>
public static string ToXml(object input)
{
//If the input is null, return null in string format
if (input == null)
{
return "null";
}
//Remove all hooks
HookManager.UnHookAll();
//Initialise the serialiser objects
StringWriter stringWriter = new StringWriter();
XmlSerializer serialiser = new XmlSerializer(input.GetType());
//Serialise the input
serialiser.Serialize(stringWriter, input);
string result = stringWriter.ToString();
//Restore all hooks
HookManager.HookAll();
//Return the result
return result;
}
/// <summary>
/// Gets the given method as a string, formatted as "Full.ReturnType Full.Class.Path.With.Function(Complete.Argument.Type argumentName)". An example is "System.Reflection.Assembly System.Reflection.Assembly.Load(System.Byte[] rawAssembly)".
/// </summary>
/// <returns>The method's full name as a string, i.e. "System.Reflection.Assembly System.Reflection.Assembly.Load(System.Byte[] rawAssembly)"</returns>
public static string Method(MethodBase method)
{
//Declare and initialise the output variable
string output = "";
//If the input is null, the output is set to null in string form, which is then returned
if (method == null)
{
return "null";
}
//If the method is a MethodInfo instance (rather than the MethodBase object that is expected in the function's argument), which is possible as the MethodInfo object inherits the MethodBase class, the return type is accessible, and is subsequently used in the output
if (method is MethodInfo)
{
output += ((MethodInfo)method).ReturnType.FullName + " ";
}
//Get the declaring type, the functino name, and open the arguments bracket
output += method.DeclaringType + "." + method.Name + "(";
//Iterate over all parameters
foreach (ParameterInfo parameterInfo in method.GetParameters())
{
//Get the parameter type and name, and include a comma for the potential following argument
output += parameterInfo.ParameterType + " " + parameterInfo.Name + ", ";
}
//If there is at least 1 argument, and all argumguments have been iterated over
if (method.GetParameters().Length > 0)
{
//The last two characters are to be removed, which equal the comma and a space, as there is no following argument
output = output.Substring(0, output.Length - 2);
}
//The closing bracket is then added
output += ")";
//And finally the output is returned
return output;
}
}
}
================================================
FILE: DotDumper/Helpers/StagnationHandler.cs
================================================
using System;
using DotDumper.HookHandlers;
using DotDumper.Hooks;
using DotDumper.Models;
namespace DotDumper.Helpers
{
/// <summary>
/// A class which contains the stagnation timer's callback function. This function is called with an interval that is defined upon the timer's creation (see program.cs in the project's root).
/// If a third interval of the given time span passes without an increase logged messages, the callback function ensures that DotDumper is shut down. This is done to escape situations where
/// process injection took place (often with native functions) and DotDumper erroneously waits for the function to return (even though it wont until the malware stops its own execution).
/// When using a sandbox, this cuts down the runtime to the point where it only runs if DotDumper is actually active, thus saving time.
/// </summary>
class StagnationHandler
{
/// <summary>
/// The amount of logs that were logged by the logger
/// </summary>
private static int _Count = 0;
/// <summary>
/// The stage of the handler, where 0 is the start, and 2 is the moment to trigger the termination clause. The stage is increased with 1 every time the callback function is called and the amount of logs (as saved in count) is equal to the amount of logs the logger saved.
/// </summary>
private static int _Stage = 0;
/// <summary>
/// The stagnation handler timer's callback function, which is called at every interval of the timer
/// </summary>
/// <param name="o">Optional parameters, as specified by the interface, but not used by this instance of the timer</param>
public static void TimerCallback(object o)
{
//If the logging count and the current count are equal, raise the stage variable. The condition where the logging is empty is not a real case, as the reflective loading of the sample already creates a single log.
if (GenericHookHelper._Logger.Count == _Count)
{
_Stage++;
}
else //If the values are not equal, the local count variable is made equal to the amount of logs that were written, and the stage is set back to 0
{
_Count = GenericHookHelper._Logger.Count;
_Stage = 0;
}
//If the stage is equal to, or more than, two, it means that the timer has called this callback twice without the creation of a single log
if (_Stage >= 2)
{
//If the DEBUG variable set to false, it means it is running in a normal environment
if (Program.DEBUG == false)
{
//Remove all hooks
HookManager.UnHookAll();
//Create a new exception with a message
Exception ex = new Exception("DotDumper stagnated, and is shutting down!");
//Create a new log entry with the exception
LogEntry entry = LogEntryHelper.Create(0, ex);
//Log the entry
GenericHookHelper._Logger.Log(entry, true, true);
//Remove all hooks
HookManager.UnHookAll();
//Set the time a year ahead, forcing the sandbox to time out
SetTime();
//Exit normally, which is called directly as all hooks are removed
Environment.Exit(0);
}
}
}
/// <summary>
/// Sets the system date and time to a year in the future, forcing the sandbox to time out of its runtime
/// </summary>
public static void SetTime()
{
//Declares and initialises the SystemTime structure with a future time
InteropFunctions.SystemTime updatedTime = new InteropFunctions.SystemTime
{
Year = (ushort)(2200),
Month = (ushort)12,
Day = (ushort)30,
Hour = (ushort)12,
Minute = (ushort)00,
Second = (ushort)0
};
//Set the time to next year, forcing the sandbox to time out
InteropFunctions.SetSystemTime(ref updatedTime);
}
}
}
================================================
FILE: DotDumper/HookHandlers/Activator/ActivatorHooks.cs
================================================
using System;
using System.Configuration.Assemblies;
using System.Globalization;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.Remoting;
using System.Security.Policy;
using DotDumper.Hooks;
namespace DotDumper.HookHandlers
{
class ActivatorHooks
{
[MethodImpl(MethodImplOptions.NoInlining)]
public static ObjectHandle CreateComInstanceFromHookStringStringByteArrayAssemblyHashAlgorithm(string assemblyName, string typeName, byte[] hashValue, AssemblyHashAlgorithm hashAlgorithm)
{
//Declare the local variable to store the object in
ObjectHandle result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
HookManager.UnHookByHookName("CreateComInstanceFromHookStringStringByteArrayAssemblyHashAlgorithm");
//Call the original function
result = Activator.CreateComInstanceFrom(assemblyName, typeName, hashValue, hashAlgorithm);
HookManager.HookByHookName("CreateComInstanceFromHookStringStringByteArrayAssemblyHashAlgorithm");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateComInstanceFromStringStringByteArrayAssemblyHashAlgorithm(), new object[] { assemblyName, typeName, hashValue, hashAlgorithm }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static ObjectHandle CreateComInstanceFromHookStringString(string assemblyName, string typeName)
{
//Declare the local variable to store the object in
ObjectHandle result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Within the DotNet framework, another CreateComInstance function is used, which is also hooked. To avoid duplicate entries in the logging, both are unhooked and rehooked
HookManager.UnHookByHookName("CreateComInstanceFromHookStringString");
HookManager.UnHookByHookName("CreateComInstanceFromHookStringStringByteArrayAssemblyHashAlgorithm");
//Call the original function
result = Activator.CreateComInstanceFrom(assemblyName, typeName);
HookManager.HookByHookName("CreateComInstanceFromHookStringString");
HookManager.HookByHookName("CreateComInstanceFromHookStringStringByteArrayAssemblyHashAlgorithm");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateComInstanceFromStringString(), new object[] { assemblyName, typeName }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static object CreateInstanceHookType(Type type)
{
//Declare the local variable to store the object in
object result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Double unhook due to DotNet internal wrappers, thereby avoiding double logging
HookManager.UnHookByHookName("CreateInstanceHookType");
HookManager.UnHookByHookName("CreateInstanceHookTypeBool");
//Call the original function
result = Activator.CreateInstance(type);
HookManager.HookByHookName("CreateInstanceHookType");
HookManager.HookByHookName("CreateInstanceHookTypeBool");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateInstanceTypeBool(), new object[] { type }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static object CreateInstanceHookTypeBool(Type type, bool nonPublic)
{
//Declare the local variable to store the object in
object result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
HookManager.UnHookByHookName("CreateInstanceHookTypeBool");
//Call the original function
result = Activator.CreateInstance(type, nonPublic);
HookManager.HookByHookName("CreateInstanceHookTypeBool");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateInstanceTypeBool(), new object[] { type, nonPublic }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static ObjectHandle CreateInstanceHookActivationContext(ActivationContext activationContext)
{
//Declare the local variable to store the object in
ObjectHandle result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
HookManager.UnHookByHookName("CreateInstanceHookActivationContext");
//Call the original function
result = Activator.CreateInstance(activationContext);
HookManager.HookByHookName("CreateInstanceHookActivationContext");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateInstanceActivationContext(), new object[] { activationContext }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static object CreateInstanceHookTypeObjectArray(Type type, params object[] args)
{
//Declare the local variable to store the object in
object result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Double unhook due to internal calling of the function to an overload
HookManager.UnHookByHookName("CreateInstanceHookTypeObjectArray");
HookManager.UnHookByHookName("CreateInstanceHookTypeBindingFlagsBinderObjectArrayCultureInfoObjectArray");
//Call the original function
result = Activator.CreateInstance(type, args);
HookManager.HookByHookName("CreateInstanceHookTypeObjectArray");
HookManager.HookByHookName("CreateInstanceHookTypeBindingFlagsBinderObjectArrayCultureInfoObjectArray");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateInstanceActivationContext(), new object[] { type, args }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static object CreateInstanceHookStringString(string assemblyName, string typeName)
{
//Declare the local variable to store the object in
object result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
HookManager.UnHookByHookName("CreateInstanceHookTypeBindingFlagsBinderObjectArrayCultureInfoObjectArray");
//Call the original function
result = Activator.CreateInstance(assemblyName, typeName);
HookManager.HookByHookName("CreateInstanceHookTypeBindingFlagsBinderObjectArrayCultureInfoObjectArray");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateInstanceStringString(), new object[] { assemblyName, typeName }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static object CreateInstanceHookTypeBindingFlagsBinderObjectArrayCultureInfo(Type type, BindingFlags bindingAttr, Binder binder, object[] args, CultureInfo culture)
{
//Declare the local variable to store the object in
object result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Double unhook due to an internal wrapper within the DotNet framework
HookManager.UnHookByHookName("CreateInstanceHookTypeBindingFlagsBinderObjectArrayCultureInfo");
HookManager.UnHookByHookName("CreateInstanceHookTypeBindingFlagsBinderObjectArrayCultureInfoObjectArray");
//Call the original function
result = Activator.CreateInstance(type, bindingAttr, binder, args, culture);
HookManager.HookByHookName("CreateInstanceHookTypeBindingFlagsBinderObjectArrayCultureInfo");
HookManager.HookByHookName("CreateInstanceHookTypeBindingFlagsBinderObjectArrayCultureInfoObjectArray");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateInstanceActivationContext(), new object[] { type, bindingAttr, binder, args, culture }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static object CreateInstanceHookTypeBindingFlagsBinderObjectArrayCultureInfoObjectArray(Type type, BindingFlags bindingAttr, Binder binder, object[] args, CultureInfo culture, object[] activationAttributes)
{
//Declare the local variable to store the object in
object result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
HookManager.UnHookByHookName("CreateInstanceHookTypeBindingFlagsBinderObjectArrayCultureInfoObjectArray");
//Call the original function
result = Activator.CreateInstance(type, bindingAttr, binder, args, culture, activationAttributes);
HookManager.HookByHookName("CreateInstanceHookTypeBindingFlagsBinderObjectArrayCultureInfoObjectArray");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateInstanceActivationContext(), new object[] { type, bindingAttr, binder, args, culture, activationAttributes }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static ObjectHandle CreateInstanceHookStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArray(string assemblyName, string typeName, bool ignoreCase, BindingFlags bindingAttr, Binder binder, object[] args, CultureInfo culture, object[] activationAttributes)
{
//Declare the local variable to store the object in
ObjectHandle result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
HookManager.UnHookByHookName("CreateInstanceHookStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArray");
//Call the original function
result = Activator.CreateInstance(assemblyName, typeName, ignoreCase, bindingAttr, binder, args, culture, activationAttributes);
HookManager.HookByHookName("CreateInstanceHookStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArray");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateInstanceStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArray(), new object[] { assemblyName, typeName, ignoreCase, bindingAttr, binder, args, culture, activationAttributes }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static ObjectHandle CreateInstanceHookActivationContextStringArray(ActivationContext activationContext, string[] activationCustomData)
{
//Declare the local variable to store the object in
ObjectHandle result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
HookManager.UnHookByHookName("CreateInstanceHookActivationContextStringArray");
//Call the original function
result = Activator.CreateInstance(activationContext, activationCustomData);
HookManager.HookByHookName("CreateInstanceHookActivationContextStringArray");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateInstanceActivationContextStringArray(), new object[] { activationContext, activationCustomData }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static ObjectHandle CreateInstanceHookStringStringObjectArray(string assemblyName, string typeName, object[] activationAttributes)
{
//Declare the local variable to store the object in
ObjectHandle result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
HookManager.UnHookByHookName("CreateInstanceHookStringStringObjectArray");
//Call the original function
result = Activator.CreateInstance(assemblyName, typeName, activationAttributes);
HookManager.HookByHookName("CreateInstanceHookStringStringObjectArray");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateInstanceStringStringObjectArray(), new object[] { assemblyName, typeName, activationAttributes }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static ObjectHandle CreateInstanceHookAppDomainStringString(AppDomain domain, string assemblyName, string typeName)
{
//Declare the local variable to store the object in
ObjectHandle result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
HookManager.UnHookByHookName("CreateInstanceHookAppDomainStringString");
//Call the original function
result = Activator.CreateInstance(domain, assemblyName, typeName);
HookManager.HookByHookName("CreateInstanceHookAppDomainStringString");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateInstanceAppDomainStringString(), new object[] { domain, assemblyName, typeName }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static ObjectHandle CreateInstanceHookStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence(string assemblyName, string typeName, bool ignoreCase, BindingFlags bindingAttr, Binder binder, object[] args, CultureInfo culture, object[] activationAttributes, Evidence securityInfo)
{
//Declare the local variable to store the object in
ObjectHandle result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
HookManager.UnHookByHookName("CreateInstanceHookStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence");
//Call the original function
result = Activator.CreateInstance(assemblyName, typeName, ignoreCase, bindingAttr, binder, args, culture, activationAttributes, securityInfo);
HookManager.HookByHookName("CreateInstanceHookStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateInstanceStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence(), new object[] { assemblyName, typeName, ignoreCase, bindingAttr, binder, args, culture, activationAttributes, securityInfo }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static ObjectHandle CreateInstanceHookAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArray(AppDomain domain, string assemblyName, string typeName, bool ignoreCase, BindingFlags bindingAttr, Binder binder, object[] args, CultureInfo culture, object[] activationAttributes)
{
//Declare the local variable to store the object in
ObjectHandle result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
HookManager.UnHookByHookName("CreateInstanceHookAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArray");
//Call the original function
result = Activator.CreateInstance(domain, assemblyName, typeName, ignoreCase, bindingAttr, binder, args, culture, activationAttributes);
HookManager.HookByHookName("CreateInstanceHookAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArray");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateInstanceAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArray(), new object[] { domain, assemblyName, typeName, ignoreCase, bindingAttr, binder, args, culture, activationAttributes }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static ObjectHandle CreateInstanceHookAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence(AppDomain domain, string assemblyName, string typeName, bool ignoreCase, BindingFlags bindingAttr, Binder binder, object[] args, CultureInfo culture, object[] activationAttributes, Evidence securityAttributes)
{
//Declare the local variable to store the object in
ObjectHandle result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
HookManager.UnHookByHookName("CreateInstanceHookAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence");
//Call the original function
result = Activator.CreateInstance(domain, assemblyName, typeName, ignoreCase, bindingAttr, binder, args, culture, activationAttributes, securityAttributes);
HookManager.HookByHookName("CreateInstanceHookAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateInstanceAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence(), new object[] { domain, assemblyName, typeName, ignoreCase, bindingAttr, binder, args, culture, activationAttributes, securityAttributes }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static ObjectHandle CreateInstanceFromHookAppDomainStringString(AppDomain domain, string assemblyFile, string typeName)
{
//Declare the local variable to store the object in
ObjectHandle result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
HookManager.UnHookByHookName("CreateInstanceFromHookAppDomainStringString");
//Call the original function
result = Activator.CreateInstanceFrom(domain, assemblyFile, typeName);
HookManager.HookByHookName("CreateInstanceFromHookAppDomainStringString");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateInstanceFromAppDomainStringString(), new object[] { domain, assemblyFile, typeName }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static ObjectHandle CreateInstanceFromHookStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence(string assemblyFile, string typeName, bool ignoreCase, BindingFlags bindingAttr, Binder binder, object[] args, CultureInfo culture, object[] activationAttributes, Evidence securityInfo)
{
//Declare the local variable to store the object in
ObjectHandle result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
HookManager.UnHookByHookName("CreateInstanceFromHookStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence");
//Call the original function
result = Activator.CreateInstanceFrom(assemblyFile, typeName, ignoreCase, bindingAttr, binder, args, culture, activationAttributes, securityInfo);
HookManager.HookByHookName("CreateInstanceFromHookStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateInstanceFromStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence(), new object[] { assemblyFile, typeName, ignoreCase, bindingAttr, binder, args, culture, activationAttributes, securityInfo }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static ObjectHandle CreateInstanceFromHookAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArray(AppDomain domain, string assemblyFile, string typeName, bool ignoreCase, BindingFlags bindingAttr, Binder binder, object[] args, CultureInfo culture, object[] activationAttributes)
{
//Declare the local variable to store the object in
ObjectHandle result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
HookManager.UnHookByHookName("CreateInstanceFromHookAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArray");
//Call the original function
result = Activator.CreateInstanceFrom(domain, assemblyFile, typeName, ignoreCase, bindingAttr, binder, args, culture, activationAttributes);
HookManager.HookByHookName("CreateInstanceFromHookAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArray");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateInstanceFromAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArray(), new object[] { domain, assemblyFile, typeName, ignoreCase, bindingAttr, binder, args, culture, activationAttributes }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static ObjectHandle CreateInstanceFromHookAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence(AppDomain domain, string assemblyFile, string typeName, bool ignoreCase, BindingFlags bindingAttr, Binder binder, object[] args, CultureInfo culture, object[] activationAttributes, Evidence securityAttributes)
{
//Declare the local variable to store the object in
ObjectHandle result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
HookManager.UnHookByHookName("CreateInstanceFromHookAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence");
//Call the original function
result = Activator.CreateInstanceFrom(domain, assemblyFile, typeName, ignoreCase, bindingAttr, binder, args, culture, activationAttributes, securityAttributes);
HookManager.HookByHookName("CreateInstanceFromHookAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateInstanceFromAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence(), new object[] { domain, assemblyFile, typeName, ignoreCase, bindingAttr, binder, args, culture, activationAttributes, securityAttributes }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static ObjectHandle CreateInstanceFromHookStringString(string assemblyFile, string typeName)
{
//Declare the local variable to store the object in
ObjectHandle result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Multi unhooking due to DotNet wrapper calls
HookManager.UnHookByHookName("CreateInstanceFromHookStringString");
HookManager.UnHookByHookName("CreateInstanceFromHookStringStringObjectArray");
HookManager.UnHookByHookName("CreateInstanceFromHookStringStringBoolBindingFlagsBinderObjectArrayCultureInfoObjectArray");
//Call the original function
result = Activator.CreateInstanceFrom(assemblyFile, typeName);
HookManager.HookByHookName("CreateInstanceFromHookStringString");
HookManager.HookByHookName("CreateInstanceFromHookStringStringObjectArray");
HookManager.HookByHookName("CreateInstanceFromHookStringStringBoolBindingFlagsBinderObjectArrayCultureInfoObjectArray");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateInstanceFromStringString(), new object[] { assemblyFile, typeName }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static ObjectHandle CreateInstanceFromHookStringStringObjectArray(string assemblyFile, string typeName, object[] activationAttributes)
{
//Declare the local variable to store the object in
ObjectHandle result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
HookManager.UnHookByHookName("CreateInstanceFromHookStringStringObjectArray");
HookManager.UnHookByHookName("CreateInstanceFromHookStringStringBoolBindingFlagsBinderObjectArrayCultureInfoObjectArray");
//Call the original function
result = Activator.CreateInstanceFrom(assemblyFile, typeName, activationAttributes);
HookManager.HookByHookName("CreateInstanceFromHookStringStringObjectArray");
HookManager.HookByHookName("CreateInstanceFromHookStringStringBoolBindingFlagsBinderObjectArrayCultureInfoObjectArray");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateInstanceFromAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence(), new object[] { assemblyFile, typeName, activationAttributes }, result);
}
//Return the process object to the caller
return result;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static ObjectHandle CreateInstanceFromHookStringStringBoolBindingFlagsBinderObjectArrayCultureInfoObjectArray(string assemblyFile, string typeName, bool ignoreCase, BindingFlags bindingAttr, Binder binder, object[] args, CultureInfo culture, object[] activationAttributes)
{
//Declare the local variable to store the object in
ObjectHandle result;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Multi unhook due to internal wrappers in the DotNet framework
HookManager.UnHookByHookName("CreateInstanceFromHookStringStringBoolBindingFlagsBinderObjectArrayCultureInfoObjectArray");
//Call the original function
result = Activator.CreateInstanceFrom(assemblyFile, typeName, ignoreCase, bindingAttr, binder, args, culture, activationAttributes);
HookManager.HookByHookName("CreateInstanceFromHookStringStringBoolBindingFlagsBinderObjectArrayCultureInfoObjectArray");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.LogSampleCall(1, OriginalManagedFunctions.ActivatorCreateInstanceFromAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence(), new object[] { assemblyFile, typeName, ignoreCase, bindingAttr, binder, args, culture, activationAttributes }, result);
}
//Return the process object to the caller
return result;
}
}
}
================================================
FILE: DotDumper/HookHandlers/Assembly/AssemblyHooks.cs
================================================
using System.Configuration.Assemblies;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Security;
using System.Security.Policy;
using DotDumper.Hooks;
namespace DotDumper.HookHandlers
{
class AssemblyHooks
{
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly GetEntryAssemblyHook()
{
return GenericHookHelper.OriginalAssembly;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly GetExecutingAssemblyHook()
{
return GenericHookHelper.OriginalAssembly;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly LoadHookByteArray(byte[] rawAssembly)
{
//Declare the local variable to store the assembly in
Assembly assembly;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("LoadHookByteArray");
//Call the original function
assembly = Assembly.Load(rawAssembly);
//Restore the hook
HookManager.HookByHookName("LoadHookByteArray");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.AssemblyLoadByteArray(), new object[] { rawAssembly }, assembly);
}
//Return the assembly to the caller
return assembly;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly LoadHookString(string assemblyString)
{
//Declare the local variable to store the assembly in
Assembly assembly;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("LoadHookString");
//Call the original function
assembly = Assembly.Load(assemblyString);
//Restore the hook
HookManager.HookByHookName("LoadHookString");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.AssemblyLoadString(), new object[] { assemblyString }, assembly);
}
//Return the assembly to the caller
return assembly;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly LoadHookStringEvidence(string assemblyString, Evidence assemblySecurity)
{
//Declare the local variable to store the assembly in
Assembly assembly;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("LoadHookStringEvidence");
//Call the original function
assembly = Assembly.Load(assemblyString, assemblySecurity);
//Restore the hook
HookManager.HookByHookName("LoadHookStringEvidence");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.AssemblyLoadStringEvidence(), new object[] { assemblyString, assemblySecurity }, assembly);
}
//Return the assembly to the caller
return assembly;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly LoadHookByteArrayByteArrayEvidence(byte[] rawAssembly, byte[] rawSymbolStore, Evidence securityEvidence)
{
//Declare the local variable to store the assembly in
Assembly assembly;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("LoadHookByteArrayByteArrayEvidence");
//Call the original function
assembly = Assembly.Load(rawAssembly, rawSymbolStore, securityEvidence);
//Restore the hook
HookManager.HookByHookName("LoadHookByteArrayByteArrayEvidence");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.AssemblyLoadByteArrayByteArrayEvidence(), new object[] { rawAssembly, rawSymbolStore, securityEvidence }, assembly);
}
//Return the assembly to the caller
return assembly;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly LoadHookAssemblyName(AssemblyName assemblyRef)
{
//Declare the local variable to store the assembly in
Assembly assembly;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("LoadHookAssemblyName");
//Call the original function
assembly = Assembly.Load(assemblyRef);
//Restore the hook
HookManager.HookByHookName("LoadHookAssemblyName");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.AssemblyLoadAssemblyName(), new object[] { assemblyRef }, assembly);
}
//Return the assembly to the caller
return assembly;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly LoadHookAssemblyNameEvidence(AssemblyName assemblyRef, Evidence assemblySecurity)
{
//Declare the local variable to store the assembly in
Assembly assembly;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("LoadHookAssemblyNameEvidence");
//Call the original function
assembly = Assembly.Load(assemblyRef, assemblySecurity);
//Restore the hook
HookManager.HookByHookName("LoadHookAssemblyNameEvidence");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.AssemblyLoadAssemblyNameEvidence(), new object[] { assemblyRef, assemblySecurity }, assembly);
}
//Return the assembly to the caller
return assembly;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly LoadHookByteArrayByteArraySecurityContextSource(byte[] rawAssembly, byte[] rawSymbolStore, SecurityContextSource securityContextSource)
{
//Declare the local variable to store the assembly in
Assembly assembly;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("LoadHookByteArrayByteArraySecurityContextSource");
//Call the original function
assembly = Assembly.Load(rawAssembly, rawSymbolStore, securityContextSource);
//Restore the hook
HookManager.HookByHookName("LoadHookByteArrayByteArraySecurityContextSource");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.AssemblyLoadByteArrayByteArraySecurityContextSource(), new object[] { rawAssembly, rawSymbolStore, securityContextSource }, assembly);
}
//Return the assembly to the caller
return assembly;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly LoadHookByteArrayByteArray(byte[] rawAssembly, byte[] rawSymbolStore)
{
//Declare the local variable to store the assembly in
Assembly assembly;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("LoadHookByteArrayByteArray");
//Call the original function
assembly = Assembly.Load(rawAssembly, rawSymbolStore);
//Restore the hook
HookManager.HookByHookName("LoadHookByteArrayByteArray");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.AssemblyLoadByteArrayByteArray(), new object[] { rawAssembly, rawSymbolStore }, assembly);
}
//Return the assembly to the caller
return assembly;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly LoadFileHookString(string path)
{
//Declare the local variable to store the assembly in
Assembly assembly;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("LoadFileHookString");
//Call the original function
assembly = Assembly.LoadFile(path);
//Restore the hook
HookManager.HookByHookName("LoadFileHookString");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.AssemblyLoadFileString(), new object[] { path }, assembly);
}
//Return the assembly to the caller
return assembly;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly LoadFileHookStringEvidence(string path, Evidence securityEvidence)
{
//Declare the local variable to store the assembly in
Assembly assembly;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("LoadFileHookStringEvidence");
//Call the original function
assembly = Assembly.LoadFile(path, securityEvidence);
//Restore the hook
HookManager.HookByHookName("LoadFileHookStringEvidence");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.AssemblyLoadFileStringEvidence(), new object[] { path, securityEvidence }, assembly);
}
//Return the assembly to the caller
return assembly;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly LoadFromHookString(string assemblyFile)
{
//Declare the local variable to store the assembly in
Assembly assembly;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("LoadFromHookString");
//Call the original function
assembly = Assembly.LoadFrom(assemblyFile);
//Restore the hook
HookManager.HookByHookName("LoadFromHookString");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.AssemblyLoadFromString(), new object[] { assemblyFile }, assembly);
}
//Return the assembly to the caller
return assembly;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly LoadFromHookStringEvidence(string assemblyFile, Evidence securityEvidence)
{
//Declare the local variable to store the assembly in
Assembly assembly;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("LoadFromHookStringEvidence");
//Call the original function
assembly = Assembly.LoadFrom(assemblyFile, securityEvidence);
//Restore the hook
HookManager.HookByHookName("LoadFromHookStringEvidence");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.AssemblyLoadFromStringEvidence(), new object[] { assemblyFile, securityEvidence }, assembly);
}
//Return the assembly to the caller
return assembly;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly LoadFromHookStringEvidenceByteArrayAssemblyHashAlgorithm(string assemblyFile, Evidence securityEvidence, byte[] hashValue, AssemblyHashAlgorithm hashAlgorithm)
{
//Declare the local variable to store the assembly in
Assembly assembly;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("LoadFromHookStringEvidenceByteArrayAssemblyHashAlgorithm");
//Call the original function
assembly = Assembly.LoadFrom(assemblyFile, securityEvidence, hashValue, hashAlgorithm);
//Restore the hook
HookManager.HookByHookName("LoadFromHookStringEvidenceByteArrayAssemblyHashAlgorithm");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.AssemblyLoadFromStringEvidenceByteArrayAssemblyHashAlgorithm(), new object[] { assemblyFile, securityEvidence, hashValue, hashAlgorithm }, assembly);
}
//Return the assembly to the caller
return assembly;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly LoadFromHookStringByteArrayAssemblyHashAlgorithm(string assemblyFile, byte[] hashValue, AssemblyHashAlgorithm hashAlgorithm)
{
//Declare the local variable to store the assembly in
Assembly assembly;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("LoadFromHookStringByteArrayAssemblyHashAlgorithm");
//Call the original function
assembly = Assembly.LoadFrom(assemblyFile, hashValue, hashAlgorithm);
//Restore the hook
HookManager.HookByHookName("LoadFromHookStringByteArrayAssemblyHashAlgorithm");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.AssemblyLoadFromStringByteArrayAssemblyHashAlgorithm(), new object[] { assemblyFile, hashValue, hashAlgorithm }, assembly);
}
//Return the assembly to the caller
return assembly;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly LoadWithPartialNameHookStringEvidence(string partialName, Evidence securityEvidence)
{
//Declare the local variable to store the assembly in
Assembly assembly;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("LoadWithPartialNameHookStringEvidence");
//Call the original function
assembly = Assembly.LoadWithPartialName(partialName, securityEvidence);
//Restore the hook
HookManager.HookByHookName("LoadWithPartialNameHookStringEvidence");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.AssemblyLoadWithPartialNameStringEvidence(), new object[] { partialName, securityEvidence }, assembly);
}
//Return the assembly to the caller
return assembly;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly LoadWithPartialNameHookString(string partialName)
{
//Declare the local variable to store the assembly in
Assembly assembly;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("LoadWithPartialNameHookString");
//Call the original function
assembly = Assembly.LoadWithPartialName(partialName);
//Restore the hook
HookManager.HookByHookName("LoadWithPartialNameHookString");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.AssemblyLoadWithPartialNameString(), new object[] { partialName }, assembly);
}
//Return the assembly to the caller
return assembly;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly ReflectionOnlyLoadHookString(string assemblyString)
{
//Declare the local variable to store the assembly in
Assembly assembly;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("ReflectionOnlyLoadHookString");
//Call the original function
assembly = Assembly.ReflectionOnlyLoad(assemblyString);
//Restore the hook
HookManager.HookByHookName("ReflectionOnlyLoadHookString");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.AssemblyReflectionOnlyLoadString(), new object[] { assemblyString }, assembly);
}
//Return the assembly to the caller
return assembly;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly ReflectionOnlyLoadHookByteArray(byte[] rawAssembly)
{
//Declare the local variable to store the assembly in
Assembly assembly;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("ReflectionOnlyLoadHookByteArray");
//Call the original function
assembly = Assembly.ReflectionOnlyLoad(rawAssembly);
//Restore the hook
HookManager.HookByHookName("ReflectionOnlyLoadHookByteArray");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.AssemblyReflectionOnlyLoadByteArray(), new object[] { rawAssembly }, assembly);
}
//Return the assembly to the caller
return assembly;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly ReflectionOnlyLoadFromHookString(string assemblyFile)
{
//Declare the local variable to store the assembly in
Assembly assembly;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("ReflectionOnlyLoadFromHookString");
//Call the original function
assembly = Assembly.ReflectionOnlyLoadFrom(assemblyFile);
//Restore the hook
HookManager.HookByHookName("ReflectionOnlyLoadFromHookString");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.AssemblyReflectionOnlyLoadFromString(), new object[] { assemblyFile }, assembly);
}
//Return the assembly to the caller
return assembly;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static Assembly UnsafeLoadFromHookString(string assemblyFile)
{
//Declare the local variable to store the assembly in
Assembly assembly;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("UnsafeLoadFromHookString");
//Call the original function
assembly = Assembly.UnsafeLoadFrom(assemblyFile);
//Restore the hook
HookManager.HookByHookName("UnsafeLoadFromHookString");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.AssemblyUnsafeLoadFromString(), new object[] { assemblyFile }, assembly);
}
//Return the assembly to the caller
return assembly;
}
}
}
================================================
FILE: DotDumper/HookHandlers/Console/ConsoleHooks.cs
================================================
using System;
using System.Runtime.CompilerServices;
using DotDumper.Hooks;
namespace DotDumper.HookHandlers
{
class ConsoleHooks
{
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteHookString(string value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteString(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteHookObject(object value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteObject(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteHookUlong(ulong value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteUlong(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteHookLong(long value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteLong(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteHookInt(int value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteInt(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteHookUint(uint value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteUint(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteHookBool(bool value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteBool(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteHookChar(char value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteChar(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteHookDecimal(decimal value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteDecimal(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteHookFloat(float value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteFloat(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteHookDouble(double value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteDouble(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteHookStringObject(string format, object arg0)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteStringObject(), new object[] { format, arg0 }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteHookStringObjectObject(string format, object arg0, object arg1)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteStringObjectObject(), new object[] { format, arg0, arg1 }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteHookStringObjectObjectObject(string format, object arg0, object arg1, object arg2)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteStringObjectObjectObject(), new object[] { format, arg0, arg1, arg2 }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteHookStringObjectObjectObjectObject(string format, object arg0, object arg1, object arg2, object arg3)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteStringObjectObjectObjectObject(), new object[] { format, arg0, arg1, arg2, arg3 }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteHookStringObjectArray(string format, params object[] arg)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteStringObjectArray(), new object[] { format, arg }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteHookCharArray(char[] buffer)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteCharArray(), new object[] { buffer }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteHookCharArrayIntInt(char[] buffer, int index, int count)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteCharArrayIntInt(), new object[] { buffer, index, count }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteLineHookString(string value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteString(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteLineHookObject(object value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteLineObject(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteLineHookUlong(ulong value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteLineUlong(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteLineHookLong(long value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteLineLong(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteLineHookInt(int value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteLineInt(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteLineHookUint(uint value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteLineUint(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteLineHookBool(bool value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteLineBool(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteLineHookChar(char value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteLineChar(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteLineHookDecimal(decimal value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteLineDecimal(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteLineHookFloat(float value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteLineFloat(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteLineHookDouble(double value)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteLineDouble(), new object[] { value }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteLineHookStringObject(string format, object arg0)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteLineStringObject(), new object[] { format, arg0 }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteLineHookStringObjectObject(string format, object arg0, object arg1)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteLineStringObjectObject(), new object[] { format, arg0, arg1 }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteLineHookStringObjectObjectObject(string format, object arg0, object arg1, object arg2)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteLineStringObjectObjectObject(), new object[] { format, arg0, arg1, arg2 }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteLineHookStringObjectObjectObjectObject(string format, object arg0, object arg1, object arg2, object arg3)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteLineStringObjectObjectObjectObject(), new object[] { format, arg0, arg1, arg2, arg3 }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteLineHookStringObjectArray(string format, params object[] arg)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteLineStringObjectArray(), new object[] { format, arg }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteLineHookCharArray(char[] buffer)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteLineCharArray(), new object[] { buffer }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteLineHookCharArrayIntInt(char[] buffer, int index, int count)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteLineCharArrayIntInt(), new object[] { buffer, index, count }, null);
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void WriteLineHook()
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
Console.WriteLine();
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConsoleWriteLine(), new object[] { }, null);
}
}
}
}
================================================
FILE: DotDumper/HookHandlers/Convert/ConvertHooks.cs
================================================
using System;
using System.Runtime.CompilerServices;
using DotDumper.Hooks;
namespace DotDumper.HookHandlers
{
class ConvertHooks
{
[MethodImpl(MethodImplOptions.NoInlining)]
public static byte[] FromBase64StringString(string s)
{
//Declare the local variable to store the object in
byte[] output;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("FromBase64StringString");
//Call the original function
output = Convert.FromBase64String(s);
//Restore the hook
HookManager.HookByHookName("FromBase64StringString");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConvertFromBase64StringString(), new object[] { s }, output);
}
//Return the process object to the caller
return output;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static byte[] FromBase64CharArrayCharyArrayIntInt(char[] inArray, int offset, int length)
{
//Declare the local variable to store the object in
byte[] output;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("FromBase64CharArrayCharyArrayIntInt");
//Call the original function
output = Convert.FromBase64CharArray(inArray, offset, length);
//Restore the hook
HookManager.HookByHookName("FromBase64CharArrayCharyArrayIntInt");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.ConvertFromBase64CharArrayCharArrayIntInt(), new object[] { inArray, offset, length }, output);
}
//Return the process object to the caller
return output;
}
}
}
================================================
FILE: DotDumper/HookHandlers/Directory/DirectoryHooks.cs
================================================
namespace DotDumper.HookHandlers
{
class DirectoryHooks
{
}
}
================================================
FILE: DotDumper/HookHandlers/Environment/EnvironmentHooks.cs
================================================
using System;
using System.Runtime.CompilerServices;
using System.Collections;
using static System.Environment;
using DotDumper.Hooks;
namespace DotDumper.HookHandlers
{
class EnvironmentHooks
{
[MethodImpl(MethodImplOptions.NoInlining)]
public static void ExitHookInt(int exitCode)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.EnvironmentExitInt(), new object[] { exitCode }, null);
//Disable the placed hook
HookManager.UnHookByHookName("ExitHookInt");
//Call the original function
Environment.Exit(exitCode);
//Restore the hook
HookManager.HookByHookName("ExitHookInt");
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static string ExpandEnvironmentVariablesHookString(string name)
{
//Declare the local variable to store the object in
string output;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("ExpandEnvironmentVariablesHookString");
//Call the original function
output = Environment.ExpandEnvironmentVariables(name);
//Restore the hook
HookManager.HookByHookName("ExpandEnvironmentVariablesHookString");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.EnvironmentExpandEnvironmentVariablesString(), new object[] { name }, output);
}
//Return the object to the caller
return output;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void FailFastHookStringException(string message, Exception exception)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.EnvironmentFailFastStringException(), new object[] { message, exception }, null);
//Disable the placed hook
HookManager.UnHookByHookName("FailFastHookStringException");
//Call the original function
Environment.FailFast(message, exception);
//Restore the hook
HookManager.HookByHookName("FailFastHookStringException");
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static void FailFastHookString(string message)
{
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.EnvironmentFailFastString(), new object[] { message }, null);
//Disable the placed hook
HookManager.UnHookByHookName("FailFastHookString");
//Call the original function
Environment.FailFast(message);
//Restore the hook
HookManager.HookByHookName("FailFastHookString");
}
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static string[] GetCommandLineArgsHook()
{
//Declare the local variable to store the object in
string[] output;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("GetCommandLineArgsHook");
//Call the original function
//TODO obtain provided CLI arguments, if any, otherwise return an empty array, as this would return the CLI arguments of DotDumper itself
//output = Environment.GetCommandLineArgs();
output = new string[0];
//Restore the hook
HookManager.HookByHookName("GetCommandLineArgsHook");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.EnvironmentGetCommandLineArgs(), new object[] { }, output);
}
//Return the object to the caller
return output;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static string GetEnvironmentVariableHookStringEnvironmentVariableTarget(string variable, EnvironmentVariableTarget target)
{
//Declare the local variable to store the object in
string output;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("GetEnvironmentVariableHookStringEnvironmentVariableTarget");
//Call the original function
output = Environment.GetEnvironmentVariable(variable, target);
//Restore the hook
HookManager.HookByHookName("GetEnvironmentVariableHookStringEnvironmentVariableTarget");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.EnvironmentGetEnvironmentVariableStringEnvironmentVariableTarget(), new object[] { variable, target }, output);
}
//Return the object to the caller
return output;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static string GetEnvironmentVariablesHookString(string variable)
{
//Declare the local variable to store the object in
string output;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("GetEnvironmentVariablesHookString");
//Call the original function
output = Environment.GetEnvironmentVariable(variable);
//Restore the hook
HookManager.HookByHookName("GetEnvironmentVariablesHookString");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.EnvironmentGetEnvironmentVariableString(), new object[] { variable }, output);
}
//Return the object to the caller
return output;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static IDictionary GetEnvironmentVariablesHookEnvironmentVariableTarget(EnvironmentVariableTarget target)
{
//Declare the local variable to store the object in
IDictionary output;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("GetEnvironmentVariablesHookEnvironmentVariableTarget");
//Call the original function
output = Environment.GetEnvironmentVariables(target);
//Restore the hook
HookManager.HookByHookName("GetEnvironmentVariablesHookEnvironmentVariableTarget");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.EnvironmentGetEnvironmentVariablesEnvironmentVariableTarget(), new object[] { target }, output);
}
//Return the object to the caller
return output;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static IDictionary GetEnvironmentVariablesHook()
{
//Declare the local variable to store the object in
IDictionary output;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("GetEnvironmentVariablesHook");
//Call the original function
output = Environment.GetEnvironmentVariables();
//Restore the hook
HookManager.HookByHookName("GetEnvironmentVariablesHook");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.EnvironmentGetEnvironmentVariables(), new object[] { }, output);
}
//Return the object to the caller
return output;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static string GetFolderPathHookSpecialFolderSpecialFolderOption(SpecialFolder folder, SpecialFolderOption option)
{
//Declare the local variable to store the object in
string output;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("GetFolderPathHookSpecialFolderSpecialFolderOption");
//Call the original function
output = Environment.GetFolderPath(folder, option);
//Restore the hook
HookManager.HookByHookName("GetFolderPathHookSpecialFolderSpecialFolderOption");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.EnvironmentGetFolderPathSpecialFolderSpecialFolderOption(), new object[] { folder, option }, output);
}
//Return the object to the caller
return output;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static string GetFolderPathHookSpecialFolder(SpecialFolder folder)
{
//Declare the local variable to store the object in
string output;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
HookManager.UnHookByHookName("GetFolderPathHookSpecialFolder");
//Call the original function
output = Environment.GetFolderPath(folder);
//Restore the hook
HookManager.HookByHookName("GetFolderPathHookSpecialFolder");
//Write the aggregated data to the log and the console
GenericHookHelper._Logger.Log(1, OriginalManagedFunctions.EnvironmentGetFolderPathSpecialFolder(), new object[] { folder }, output);
}
//Return the object to the caller
return output;
}
[MethodImpl(MethodImplOptions.NoInlining)]
public static string[] GetLogicalDrivesHook()
{
//Declare the local variable to store the object in
string[] output;
//Enable the thread safe lock, as a launched program can be multi-threaded
lock (GenericHookHelper.SyncLock)
{
//Disable the placed hook
Ho
gitextract_4_7p2e3s/
├── DotDumper/
│ ├── ArgumentHandler.cs
│ ├── Config.cs
│ ├── DotDumper.csproj
│ ├── Helpers/
│ │ ├── ArgumentHelper.cs
│ │ ├── AssemblyMapper.cs
│ │ ├── Hashes.cs
│ │ ├── LogEntryHelper.cs
│ │ ├── MissedAssemblyDumper.cs
│ │ ├── RaceConditionHandler.cs
│ │ ├── Serialise.cs
│ │ └── StagnationHandler.cs
│ ├── HookHandlers/
│ │ ├── Activator/
│ │ │ └── ActivatorHooks.cs
│ │ ├── Assembly/
│ │ │ └── AssemblyHooks.cs
│ │ ├── Console/
│ │ │ └── ConsoleHooks.cs
│ │ ├── Convert/
│ │ │ └── ConvertHooks.cs
│ │ ├── Directory/
│ │ │ └── DirectoryHooks.cs
│ │ ├── Environment/
│ │ │ └── EnvironmentHooks.cs
│ │ ├── File/
│ │ │ └── FileHooks.cs
│ │ ├── GenericHookHelper.cs
│ │ ├── MethodBase/
│ │ │ └── MethodBaseHooks.cs
│ │ ├── Path/
│ │ │ └── PathHooks.cs
│ │ ├── Process/
│ │ │ └── ProcessHooks.cs
│ │ ├── ResourceManager/
│ │ │ └── ResourceManagerHooks.cs
│ │ ├── Thread/
│ │ │ └── ThreadHooks.cs
│ │ └── Type/
│ │ ├── TypeHooks.cs
│ │ └── TypeHooksHelper.cs
│ ├── Hooks/
│ │ ├── Hook.cs
│ │ ├── HookManager.cs
│ │ ├── InteropFunctions.cs
│ │ ├── OriginalManagedFunctions.cs
│ │ └── OriginalUnmanagedFunctions.cs
│ ├── Logger.cs
│ ├── Models/
│ │ ├── Argument.cs
│ │ ├── AssemblyObject.cs
│ │ ├── Hash.cs
│ │ ├── LogEntry.cs
│ │ └── UnmanagedMethodInfo.cs
│ ├── Pipes/
│ │ └── PipeManager.cs
│ ├── Program.cs
│ ├── Properties/
│ │ └── AssemblyInfo.cs
│ ├── app.config
│ ├── bin/
│ │ └── Debug/
│ │ ├── DotDumper.exe.config
│ │ ├── DotDumper.pdb
│ │ ├── System.Buffers.xml
│ │ ├── System.Memory.xml
│ │ ├── System.Numerics.Vectors.xml
│ │ ├── System.Runtime.CompilerServices.Unsafe.xml
│ │ └── System.Security.Cryptography.Pkcs.xml
│ ├── obj/
│ │ ├── Debug/
│ │ │ ├── .NETFramework,Version=v4.7.2.AssemblyAttributes.cs
│ │ │ ├── .NETFramework,Version=v4.8.AssemblyAttributes.cs
│ │ │ ├── DesignTimeResolveAssemblyReferences.cache
│ │ │ ├── DesignTimeResolveAssemblyReferencesInput.cache
│ │ │ ├── DotDumper.csproj.AssemblyReference.cache
│ │ │ ├── DotDumper.csproj.CopyComplete
│ │ │ ├── DotDumper.csproj.CoreCompileInputs.cache
│ │ │ ├── DotDumper.csproj.FileListAbsolute.txt
│ │ │ └── DotDumper.pdb
│ │ └── x64/
│ │ └── Debug/
│ │ ├── .NETFramework,Version=v4.7.2.AssemblyAttributes.cs
│ │ ├── DesignTimeResolveAssemblyReferencesInput.cache
│ │ ├── DotDumper.csproj.AssemblyReference.cache
│ │ ├── DotDumper.csproj.CoreCompileInputs.cache
│ │ ├── DotDumper.csproj.FileListAbsolute.txt
│ │ └── DotDumper.pdb
│ └── packages.config
├── DotDumper.sln
├── LICENSE
├── README.md
└── packages/
├── PeNet.2.9.9/
│ ├── .signature.p7s
│ └── PeNet.2.9.9.nupkg
├── PeNet.Asn1.2.0.0/
│ ├── .signature.p7s
│ └── PeNet.Asn1.2.0.0.nupkg
├── System.Buffers.4.5.1/
│ ├── .signature.p7s
│ ├── LICENSE.TXT
│ ├── System.Buffers.4.5.1.nupkg
│ ├── THIRD-PARTY-NOTICES.TXT
│ ├── lib/
│ │ ├── net461/
│ │ │ └── System.Buffers.xml
│ │ ├── netcoreapp2.0/
│ │ │ └── _._
│ │ ├── netstandard1.1/
│ │ │ └── System.Buffers.xml
│ │ ├── netstandard2.0/
│ │ │ └── System.Buffers.xml
│ │ └── uap10.0.16299/
│ │ └── _._
│ ├── ref/
│ │ ├── net45/
│ │ │ └── System.Buffers.xml
│ │ ├── netcoreapp2.0/
│ │ │ └── _._
│ │ ├── netstandard1.1/
│ │ │ └── System.Buffers.xml
│ │ ├── netstandard2.0/
│ │ │ └── System.Buffers.xml
│ │ └── uap10.0.16299/
│ │ └── _._
│ ├── useSharedDesignerContext.txt
│ └── version.txt
├── System.Diagnostics.Process.4.3.0/
│ ├── .signature.p7s
│ ├── System.Diagnostics.Process.4.3.0.nupkg
│ ├── ThirdPartyNotices.txt
│ ├── dotnet_library_license.txt
│ ├── lib/
│ │ ├── MonoAndroid10/
│ │ │ └── _._
│ │ ├── MonoTouch10/
│ │ │ └── _._
│ │ ├── xamarinios10/
│ │ │ └── _._
│ │ ├── xamarinmac20/
│ │ │ └── _._
│ │ ├── xamarintvos10/
│ │ │ └── _._
│ │ └── xamarinwatchos10/
│ │ └── _._
│ ├── ref/
│ │ ├── MonoAndroid10/
│ │ │ └── _._
│ │ ├── MonoTouch10/
│ │ │ └── _._
│ │ ├── netstandard1.3/
│ │ │ ├── System.Diagnostics.Process.xml
│ │ │ ├── de/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── es/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── fr/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── it/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── ja/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── ko/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── ru/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── zh-hans/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ └── zh-hant/
│ │ │ └── System.Diagnostics.Process.xml
│ │ ├── netstandard1.4/
│ │ │ ├── System.Diagnostics.Process.xml
│ │ │ ├── de/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── es/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── fr/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── it/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── ja/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── ko/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── ru/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ ├── zh-hans/
│ │ │ │ └── System.Diagnostics.Process.xml
│ │ │ └── zh-hant/
│ │ │ └── System.Diagnostics.Process.xml
│ │ ├── xamarinios10/
│ │ │ └── _._
│ │ ├── xamarinmac20/
│ │ │ └── _._
│ │ ├── xamarintvos10/
│ │ │ └── _._
│ │ └── xamarinwatchos10/
│ │ └── _._
│ └── runtimes/
│ └── win7/
│ └── lib/
│ └── netcore50/
│ └── _._
├── System.Memory.4.5.5/
│ ├── .signature.p7s
│ ├── LICENSE.TXT
│ ├── System.Memory.4.5.5.nupkg
│ ├── THIRD-PARTY-NOTICES.TXT
│ ├── lib/
│ │ ├── net461/
│ │ │ └── System.Memory.xml
│ │ ├── netcoreapp2.1/
│ │ │ └── _._
│ │ ├── netstandard1.1/
│ │ │ └── System.Memory.xml
│ │ └── netstandard2.0/
│ │ └── System.Memory.xml
│ ├── ref/
│ │ └── netcoreapp2.1/
│ │ └── _._
│ ├── useSharedDesignerContext.txt
│ └── version.txt
├── System.Numerics.Vectors.4.5.0/
│ ├── .signature.p7s
│ ├── LICENSE.TXT
│ ├── System.Numerics.Vectors.4.5.0.nupkg
│ ├── THIRD-PARTY-NOTICES.TXT
│ ├── lib/
│ │ ├── MonoAndroid10/
│ │ │ └── _._
│ │ ├── MonoTouch10/
│ │ │ └── _._
│ │ ├── net46/
│ │ │ └── System.Numerics.Vectors.xml
│ │ ├── netcoreapp2.0/
│ │ │ └── _._
│ │ ├── netstandard1.0/
│ │ │ └── System.Numerics.Vectors.xml
│ │ ├── netstandard2.0/
│ │ │ └── System.Numerics.Vectors.xml
│ │ ├── portable-net45+win8+wp8+wpa81/
│ │ │ └── System.Numerics.Vectors.xml
│ │ ├── uap10.0.16299/
│ │ │ └── _._
│ │ ├── xamarinios10/
│ │ │ └── _._
│ │ ├── xamarinmac20/
│ │ │ └── _._
│ │ ├── xamarintvos10/
│ │ │ └── _._
│ │ └── xamarinwatchos10/
│ │ └── _._
│ ├── ref/
│ │ ├── MonoAndroid10/
│ │ │ └── _._
│ │ ├── MonoTouch10/
│ │ │ └── _._
│ │ ├── net45/
│ │ │ └── System.Numerics.Vectors.xml
│ │ ├── net46/
│ │ │ └── System.Numerics.Vectors.xml
│ │ ├── netcoreapp2.0/
│ │ │ └── _._
│ │ ├── netstandard1.0/
│ │ │ └── System.Numerics.Vectors.xml
│ │ ├── netstandard2.0/
│ │ │ └── System.Numerics.Vectors.xml
│ │ ├── uap10.0.16299/
│ │ │ └── _._
│ │ ├── xamarinios10/
│ │ │ └── _._
│ │ ├── xamarinmac20/
│ │ │ └── _._
│ │ ├── xamarintvos10/
│ │ │ └── _._
│ │ └── xamarinwatchos10/
│ │ └── _._
│ ├── useSharedDesignerContext.txt
│ └── version.txt
├── System.Runtime.CompilerServices.Unsafe.6.0.0/
│ ├── .signature.p7s
│ ├── LICENSE.TXT
│ ├── System.Runtime.CompilerServices.Unsafe.6.0.0.nupkg
│ ├── THIRD-PARTY-NOTICES.TXT
│ ├── buildTransitive/
│ │ ├── netcoreapp2.0/
│ │ │ └── System.Runtime.CompilerServices.Unsafe.targets
│ │ └── netcoreapp3.1/
│ │ └── _._
│ ├── lib/
│ │ ├── net461/
│ │ │ └── System.Runtime.CompilerServices.Unsafe.xml
│ │ ├── net6.0/
│ │ │ └── System.Runtime.CompilerServices.Unsafe.xml
│ │ ├── netcoreapp3.1/
│ │ │ └── System.Runtime.CompilerServices.Unsafe.xml
│ │ └── netstandard2.0/
│ │ └── System.Runtime.CompilerServices.Unsafe.xml
│ └── useSharedDesignerContext.txt
└── System.Security.Cryptography.Pkcs.6.0.1/
├── .signature.p7s
├── LICENSE.TXT
├── System.Security.Cryptography.Pkcs.6.0.1.nupkg
├── THIRD-PARTY-NOTICES.TXT
├── buildTransitive/
│ ├── netcoreapp2.0/
│ │ └── System.Security.Cryptography.Pkcs.targets
│ └── netcoreapp3.1/
│ └── _._
├── lib/
│ ├── net461/
│ │ └── System.Security.Cryptography.Pkcs.xml
│ ├── net6.0/
│ │ └── System.Security.Cryptography.Pkcs.xml
│ ├── netcoreapp3.1/
│ │ └── System.Security.Cryptography.Pkcs.xml
│ ├── netstandard2.0/
│ │ └── System.Security.Cryptography.Pkcs.xml
│ └── netstandard2.1/
│ └── System.Security.Cryptography.Pkcs.xml
├── runtimes/
│ └── win/
│ └── lib/
│ ├── net461/
│ │ └── System.Security.Cryptography.Pkcs.xml
│ ├── net6.0/
│ │ └── System.Security.Cryptography.Pkcs.xml
│ ├── netcoreapp3.1/
│ │ └── System.Security.Cryptography.Pkcs.xml
│ ├── netstandard2.0/
│ │ └── System.Security.Cryptography.Pkcs.xml
│ └── netstandard2.1/
│ └── System.Security.Cryptography.Pkcs.xml
└── useSharedDesignerContext.txt
SYMBOL INDEX (553 symbols across 38 files)
FILE: DotDumper/ArgumentHandler.cs
class ArgumentHandler (line 10) | class ArgumentHandler
method CombineMarkerAndDescription (line 160) | private static string CombineMarkerAndDescription(string marker, strin...
method GetHelpMessage (line 170) | private static string GetHelpMessage()
method CheckHelp (line 202) | private static void CheckHelp(string[] args)
method CheckFile (line 245) | private static void CheckFile(string value)
method ParseArguments (line 280) | public static void ParseArguments(string[] args)
method SetLoggerFolderName (line 502) | private static void SetLoggerFolderName()
method NextIndexExists (line 526) | private static bool NextIndexExists(string[] args, int index)
method SetDllArguments (line 545) | private static void SetDllArguments(string[] args, int payloadArgument...
method HandleArray (line 751) | private static string[] HandleArray(string value)
method IsEqual (line 762) | private static bool IsEqual(string string1, string string2)
FILE: DotDumper/Config.cs
class Config (line 6) | class Config
FILE: DotDumper/Helpers/ArgumentHelper.cs
class ArgumentHelper (line 14) | class ArgumentHelper
method ContainsHash (line 22) | public static bool ContainsHash(List<Hash> hashes, Hash hash)
method SaveValue (line 43) | public static Tuple<string, List<Hash>> SaveValue(object input)
method Create (line 122) | public static Argument Create(object input, string argumentName)
method Create (line 144) | public static List<Argument> Create(MethodBase method, object[] parame...
method HandleCollection (line 189) | private static Tuple<string, List<Hash>> HandleCollection(object colle...
FILE: DotDumper/Helpers/AssemblyMapper.cs
class AssemblyMapper (line 13) | class AssemblyMapper
method GetMethod (line 19) | private static string GetMethod(MethodInfo method)
method CreateMapping (line 39) | public static Dictionary<string, Assembly> CreateMapping()
method ProcessStackTraceLine (line 80) | public static Assembly ProcessStackTraceLine(string stackTraceLine)
method ProcessStackTraceOld (line 101) | public static string ProcessStackTraceOld(List<string> stackTraceLines)
method ProcessStackTrace (line 135) | public static Tuple<Assembly, List<AssemblyObject>> ProcessStackTrace(...
method IsComingFromSample (line 184) | public static bool IsComingFromSample(List<string> stackTraceLines)
FILE: DotDumper/Helpers/Hashes.cs
class Hashes (line 11) | class Hashes
method Md5 (line 18) | public static string Md5(byte[] data)
method Sha1 (line 29) | public static string Sha1(byte[] data)
method Sha256 (line 40) | public static string Sha256(byte[] data)
method Sha384 (line 51) | public static string Sha384(byte[] data)
method Sha512 (line 62) | public static string Sha512(byte[] data)
method TypeRef (line 73) | public static string TypeRef(byte[] data)
method ImportHash (line 101) | public static string ImportHash(byte[] data)
method AuthenticodeSha256 (line 124) | public static string AuthenticodeSha256(byte[] data)
method Authenticode (line 135) | private static string Authenticode(byte[] data, HashAlgorithm hashAlgo...
method CalculateHash (line 163) | private static string CalculateHash(HashAlgorithm hashAlgorithm, byte[...
FILE: DotDumper/Helpers/LogEntryHelper.cs
class LogEntryHelper (line 13) | class LogEntryHelper
method Create (line 21) | public static LogEntry Create(int stackTraceOffset, Exception ex)
method Create (line 35) | public static LogEntry Create(UnmanagedMethodInfo unmanagedMethodInfo,...
method Create (line 50) | public static LogEntry Create(int stackTraceOffset, MethodBase method,...
FILE: DotDumper/Helpers/MissedAssemblyDumper.cs
class MissedAssemblyDumper (line 13) | class MissedAssemblyDumper
method MissedAssemblyDumper (line 28) | static MissedAssemblyDumper()
method Dump (line 46) | public static void Dump()
method ExcludeAssembly (line 123) | private static bool ExcludeAssembly(Assembly assembly)
FILE: DotDumper/Helpers/RaceConditionHandler.cs
class RaceConditionHandler (line 11) | class RaceConditionHandler
method StartTimer (line 22) | public static void StartTimer(string hookName)
method TimerCallback (line 39) | private static void TimerCallback(object o)
FILE: DotDumper/Helpers/Serialise.cs
class Serialise (line 12) | class Serialise
method ToJson (line 19) | public static string ToJson(object input)
method ToXml (line 43) | public static string ToXml(object input)
method Method (line 69) | public static string Method(MethodBase method)
FILE: DotDumper/Helpers/StagnationHandler.cs
class StagnationHandler (line 14) | class StagnationHandler
method TimerCallback (line 30) | public static void TimerCallback(object o)
method SetTime (line 70) | public static void SetTime()
FILE: DotDumper/HookHandlers/Activator/ActivatorHooks.cs
class ActivatorHooks (line 12) | class ActivatorHooks
method CreateComInstanceFromHookStringStringByteArrayAssemblyHashAlgorithm (line 14) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateComInstanceFromHookStringString (line 36) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateInstanceHookType (line 61) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateInstanceHookTypeBool (line 86) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateInstanceHookActivationContext (line 108) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateInstanceHookTypeObjectArray (line 130) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateInstanceHookStringString (line 155) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateInstanceHookTypeBindingFlagsBinderObjectArrayCultureInfo (line 177) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateInstanceHookTypeBindingFlagsBinderObjectArrayCultureInfoObjectArray (line 202) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateInstanceHookStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArray (line 224) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateInstanceHookActivationContextStringArray (line 246) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateInstanceHookStringStringObjectArray (line 268) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateInstanceHookAppDomainStringString (line 290) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateInstanceHookStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence (line 312) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateInstanceHookAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArray (line 334) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateInstanceHookAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence (line 356) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateInstanceFromHookAppDomainStringString (line 378) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateInstanceFromHookStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence (line 400) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateInstanceFromHookAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArray (line 422) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateInstanceFromHookAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence (line 444) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateInstanceFromHookStringString (line 466) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateInstanceFromHookStringStringObjectArray (line 493) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateInstanceFromHookStringStringBoolBindingFlagsBinderObjectArrayCultureInfoObjectArray (line 517) | [MethodImpl(MethodImplOptions.NoInlining)]
FILE: DotDumper/HookHandlers/Assembly/AssemblyHooks.cs
class AssemblyHooks (line 10) | class AssemblyHooks
method GetEntryAssemblyHook (line 12) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetExecutingAssemblyHook (line 18) | [MethodImpl(MethodImplOptions.NoInlining)]
method LoadHookByteArray (line 24) | [MethodImpl(MethodImplOptions.NoInlining)]
method LoadHookString (line 48) | [MethodImpl(MethodImplOptions.NoInlining)]
method LoadHookStringEvidence (line 72) | [MethodImpl(MethodImplOptions.NoInlining)]
method LoadHookByteArrayByteArrayEvidence (line 96) | [MethodImpl(MethodImplOptions.NoInlining)]
method LoadHookAssemblyName (line 120) | [MethodImpl(MethodImplOptions.NoInlining)]
method LoadHookAssemblyNameEvidence (line 144) | [MethodImpl(MethodImplOptions.NoInlining)]
method LoadHookByteArrayByteArraySecurityContextSource (line 168) | [MethodImpl(MethodImplOptions.NoInlining)]
method LoadHookByteArrayByteArray (line 192) | [MethodImpl(MethodImplOptions.NoInlining)]
method LoadFileHookString (line 216) | [MethodImpl(MethodImplOptions.NoInlining)]
method LoadFileHookStringEvidence (line 240) | [MethodImpl(MethodImplOptions.NoInlining)]
method LoadFromHookString (line 265) | [MethodImpl(MethodImplOptions.NoInlining)]
method LoadFromHookStringEvidence (line 289) | [MethodImpl(MethodImplOptions.NoInlining)]
method LoadFromHookStringEvidenceByteArrayAssemblyHashAlgorithm (line 314) | [MethodImpl(MethodImplOptions.NoInlining)]
method LoadFromHookStringByteArrayAssemblyHashAlgorithm (line 338) | [MethodImpl(MethodImplOptions.NoInlining)]
method LoadWithPartialNameHookStringEvidence (line 362) | [MethodImpl(MethodImplOptions.NoInlining)]
method LoadWithPartialNameHookString (line 386) | [MethodImpl(MethodImplOptions.NoInlining)]
method ReflectionOnlyLoadHookString (line 410) | [MethodImpl(MethodImplOptions.NoInlining)]
method ReflectionOnlyLoadHookByteArray (line 434) | [MethodImpl(MethodImplOptions.NoInlining)]
method ReflectionOnlyLoadFromHookString (line 458) | [MethodImpl(MethodImplOptions.NoInlining)]
method UnsafeLoadFromHookString (line 482) | [MethodImpl(MethodImplOptions.NoInlining)]
FILE: DotDumper/HookHandlers/Console/ConsoleHooks.cs
class ConsoleHooks (line 7) | class ConsoleHooks
method WriteHookString (line 9) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteHookObject (line 20) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteHookUlong (line 31) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteHookLong (line 42) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteHookInt (line 53) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteHookUint (line 64) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteHookBool (line 75) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteHookChar (line 86) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteHookDecimal (line 97) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteHookFloat (line 108) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteHookDouble (line 119) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteHookStringObject (line 130) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteHookStringObjectObject (line 141) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteHookStringObjectObjectObject (line 152) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteHookStringObjectObjectObjectObject (line 163) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteHookStringObjectArray (line 174) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteHookCharArray (line 185) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteHookCharArrayIntInt (line 196) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteLineHookString (line 207) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteLineHookObject (line 218) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteLineHookUlong (line 229) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteLineHookLong (line 240) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteLineHookInt (line 251) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteLineHookUint (line 262) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteLineHookBool (line 273) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteLineHookChar (line 284) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteLineHookDecimal (line 295) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteLineHookFloat (line 306) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteLineHookDouble (line 317) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteLineHookStringObject (line 328) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteLineHookStringObjectObject (line 339) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteLineHookStringObjectObjectObject (line 350) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteLineHookStringObjectObjectObjectObject (line 361) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteLineHookStringObjectArray (line 372) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteLineHookCharArray (line 383) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteLineHookCharArrayIntInt (line 394) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteLineHook (line 405) | [MethodImpl(MethodImplOptions.NoInlining)]
FILE: DotDumper/HookHandlers/Convert/ConvertHooks.cs
class ConvertHooks (line 7) | class ConvertHooks
method FromBase64StringString (line 9) | [MethodImpl(MethodImplOptions.NoInlining)]
method FromBase64CharArrayCharyArrayIntInt (line 33) | [MethodImpl(MethodImplOptions.NoInlining)]
FILE: DotDumper/HookHandlers/Directory/DirectoryHooks.cs
class DirectoryHooks (line 3) | class DirectoryHooks
FILE: DotDumper/HookHandlers/Environment/EnvironmentHooks.cs
class EnvironmentHooks (line 9) | class EnvironmentHooks
method ExitHookInt (line 11) | [MethodImpl(MethodImplOptions.NoInlining)]
method ExpandEnvironmentVariablesHookString (line 29) | [MethodImpl(MethodImplOptions.NoInlining)]
method FailFastHookStringException (line 53) | [MethodImpl(MethodImplOptions.NoInlining)]
method FailFastHookString (line 71) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetCommandLineArgsHook (line 89) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetEnvironmentVariableHookStringEnvironmentVariableTarget (line 116) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetEnvironmentVariablesHookString (line 140) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetEnvironmentVariablesHookEnvironmentVariableTarget (line 164) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetEnvironmentVariablesHook (line 188) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetFolderPathHookSpecialFolderSpecialFolderOption (line 212) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetFolderPathHookSpecialFolder (line 236) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetLogicalDrivesHook (line 260) | [MethodImpl(MethodImplOptions.NoInlining)]
method SetEnvironmentVariableHookStringStringEnvironmentVariableTarget (line 284) | [MethodImpl(MethodImplOptions.NoInlining)]
method SetEnvironmentVariableHookStringString (line 302) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetResourceFromDefaultHookString (line 320) | [MethodImpl(MethodImplOptions.NoInlining)]
FILE: DotDumper/HookHandlers/File/FileHooks.cs
class FileHooks (line 10) | class FileHooks
method AppendAllLinesHookStringIenumerableString (line 12) | [MethodImpl(MethodImplOptions.NoInlining)]
method AppendAllLinesHookStringIenumerableStringEncoding (line 30) | [MethodImpl(MethodImplOptions.NoInlining)]
method AppendAllTextHookStringStringEncoding (line 48) | [MethodImpl(MethodImplOptions.NoInlining)]
method AppendAllTextHookStringString (line 66) | [MethodImpl(MethodImplOptions.NoInlining)]
method AppendTextHookString (line 84) | [MethodImpl(MethodImplOptions.NoInlining)]
method CopyHookStringString (line 108) | [MethodImpl(MethodImplOptions.NoInlining)]
method CopyHookStringStringBoolean (line 129) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateHookString (line 147) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateHookStringInt (line 171) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateHookStringIntFileOptions (line 195) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateHookStringIntFileOptionsFileSecurity (line 219) | [MethodImpl(MethodImplOptions.NoInlining)]
method CreateTextHookString (line 243) | [MethodImpl(MethodImplOptions.NoInlining)]
method DecryptHookString (line 267) | [MethodImpl(MethodImplOptions.NoInlining)]
method DeleteHookString (line 285) | [MethodImpl(MethodImplOptions.NoInlining)]
method EncryptHookString (line 303) | [MethodImpl(MethodImplOptions.NoInlining)]
method ExiststHookString (line 321) | [MethodImpl(MethodImplOptions.NoInlining)]
method MoveHookStringString (line 345) | [MethodImpl(MethodImplOptions.NoInlining)]
method OpenHookStringFileModeFileAccessFileShare (line 363) | [MethodImpl(MethodImplOptions.NoInlining)]
method OpenHookStringFileModeFileAccess (line 387) | [MethodImpl(MethodImplOptions.NoInlining)]
method OpenHookStringFileMode (line 411) | [MethodImpl(MethodImplOptions.NoInlining)]
method OpenTextHookString (line 435) | [MethodImpl(MethodImplOptions.NoInlining)]
method OpenWriteHookString (line 459) | [MethodImpl(MethodImplOptions.NoInlining)]
method ReadAllLinesHookString (line 483) | [MethodImpl(MethodImplOptions.NoInlining)]
method ReadAllLinesHookStringEncoding (line 507) | [MethodImpl(MethodImplOptions.NoInlining)]
method ReadAllTextHookStringEncoding (line 531) | [MethodImpl(MethodImplOptions.NoInlining)]
method ReadAllTextHookString (line 555) | [MethodImpl(MethodImplOptions.NoInlining)]
method ReadLinesHookString (line 579) | [MethodImpl(MethodImplOptions.NoInlining)]
method ReadLinesHookStringEncoding (line 603) | [MethodImpl(MethodImplOptions.NoInlining)]
method ReplaceHookStringStringString (line 627) | [MethodImpl(MethodImplOptions.NoInlining)]
method ReplaceHookStringStringStringBoolean (line 645) | [MethodImpl(MethodImplOptions.NoInlining)]
method SetAccessControlHookStringFileSecurity (line 663) | [MethodImpl(MethodImplOptions.NoInlining)]
method SetAttributesHookStringFileAttributes (line 681) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteAllBytesHookStringByteArray (line 699) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteAllLinesHookStringStringArray (line 717) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteAllLinesHookStringStringArrayEncoding (line 735) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteAllLinesHookStringIenumerableString (line 753) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteAllLinesHookStringIenumerableStringEncoding (line 771) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteAllTextHookStringString (line 789) | [MethodImpl(MethodImplOptions.NoInlining)]
method WriteAllTextHookStringStringEncoding (line 807) | [MethodImpl(MethodImplOptions.NoInlining)]
method ReadAllBytesHookString (line 825) | [MethodImpl(MethodImplOptions.NoInlining)]
FILE: DotDumper/HookHandlers/GenericHookHelper.cs
class GenericHookHelper (line 16) | class GenericHookHelper
method GetStackTraceAndAssemblyMapping (line 38) | public static string GetStackTraceAndAssemblyMapping(int offset)
method GetStackTraceRaw (line 68) | public static List<string> GetStackTraceRaw(int offset)
method SaveFile (line 102) | public static string SaveFile(string fileName, byte[] data)
method SaveFile (line 119) | public static Tuple<string, Models.Hash> SaveFile(byte[] data)
method SaveFile (line 140) | public static Tuple<string, Models.Hash> SaveFile(string data)
method FileReadAllBytes (line 151) | public static byte[] FileReadAllBytes(string path)
method FileAppendAllText (line 164) | public static void FileAppendAllText(string path, string contents)
method FileWriteAllBytes (line 176) | public static void FileWriteAllBytes(string path, byte[] bytes)
method PathGetFileName (line 188) | public static string PathGetFileName(string path)
method ThreadSleep (line 200) | public static void ThreadSleep(int milliseconds)
method DirectoryCreateDirectory (line 212) | public static DirectoryInfo DirectoryCreateDirectory(string folder)
method ConsoleWriteLine (line 224) | public static void ConsoleWriteLine(string value)
method GetAsByteArray (line 236) | public static byte[] GetAsByteArray(Assembly assembly)
FILE: DotDumper/HookHandlers/MethodBase/MethodBaseHooks.cs
class MethodBaseHooks (line 7) | class MethodBaseHooks
method InvokeHookObjectObjectArray (line 9) | [MethodImpl(MethodImplOptions.NoInlining)]
FILE: DotDumper/HookHandlers/Path/PathHooks.cs
class PathHooks (line 7) | class PathHooks
method ChangeExtensionHookStringString (line 9) | [MethodImpl(MethodImplOptions.NoInlining)]
method CombineHookStringString (line 33) | [MethodImpl(MethodImplOptions.NoInlining)]
method CombineHookStringStringString (line 57) | [MethodImpl(MethodImplOptions.NoInlining)]
method CombineHookStringStringStringString (line 81) | [MethodImpl(MethodImplOptions.NoInlining)]
method CombineHookStringArray (line 105) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetDirectoryNameHookString (line 129) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetExtensionHookString (line 153) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetFileNameHookString (line 177) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetFileNameWithoutExtensionHookString (line 201) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetFullPathHookString (line 225) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetPathRootHookString (line 249) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetRandomFileNameHook (line 273) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetTempFileNameHook (line 297) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetTempPathHook (line 321) | [MethodImpl(MethodImplOptions.NoInlining)]
FILE: DotDumper/HookHandlers/Process/ProcessHooks.cs
class ProcessHooks (line 8) | class ProcessHooks
method GetCurrentProcessHook (line 11) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetProcessByIdHookIntString (line 35) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetProcessByIdHookInt (line 59) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetProcessesHook (line 83) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetProcessesHookString (line 107) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetProcessesByNameHookString (line 131) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetProcessesByNameHookStringString (line 155) | [MethodImpl(MethodImplOptions.NoInlining)]
method ProcessStartHookStringString (line 179) | [MethodImpl(MethodImplOptions.NoInlining)]
method ProcessStartHookProcessStartInfo (line 203) | [MethodImpl(MethodImplOptions.NoInlining)]
method ProcessStartHookString (line 226) | [MethodImpl(MethodImplOptions.NoInlining)]
method ProcessStartHookStringStringStringSecureStringString (line 249) | [MethodImpl(MethodImplOptions.NoInlining)]
method ProcessStartHookStringStringSecureStringString (line 273) | [MethodImpl(MethodImplOptions.NoInlining)]
FILE: DotDumper/HookHandlers/ResourceManager/ResourceManagerHooks.cs
class ResourceManagerHooks (line 11) | class ResourceManagerHooks
method GetObjectHookString (line 13) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetObjectHookStringCultureInfo (line 47) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetStringHookString (line 82) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetStringHookStringCultureInfo (line 116) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetStreamHookString (line 151) | [MethodImpl(MethodImplOptions.NoInlining)]
method GetStreamHookStringCultureInfo (line 186) | [MethodImpl(MethodImplOptions.NoInlining)]
method BruteStringGet (line 221) | private static string BruteStringGet(string resourceName)
method BruteObjectGet (line 252) | private static object BruteObjectGet(string resourceName)
method BruteStreamGet (line 283) | private static UnmanagedMemoryStream BruteStreamGet(string resourceName)
FILE: DotDumper/HookHandlers/Thread/ThreadHooks.cs
class ThreadHooks (line 8) | class ThreadHooks
method SleepHookInt (line 10) | [MethodImpl(MethodImplOptions.NoInlining)]
method SleepHookTimeSpan (line 36) | [MethodImpl(MethodImplOptions.NoInlining)]
FILE: DotDumper/HookHandlers/Type/TypeHooks.cs
class TypeHooks (line 9) | class TypeHooks
method InvokeMemberHookStringBindingFlagsBinderObjectObjectArrayCultureInfo (line 11) | [MethodImpl(MethodImplOptions.NoInlining)]
method InvokeMemberHookStringBindingFlagsBinderObjectObjectArray (line 35) | [MethodImpl(MethodImplOptions.NoInlining)]
FILE: DotDumper/HookHandlers/Type/TypeHooksHelper.cs
class TypeHooksHelper (line 10) | class TypeHooksHelper
method InvokeMemberHandler (line 12) | public static void InvokeMemberHandler(string functionName, Type type,...
method GetMethodInfo (line 38) | private static MethodInfo GetMethodInfo(Type type, string name, object...
FILE: DotDumper/Hooks/Hook.cs
method VirtualProtect (line 23) | [DllImport("kernel32.dll", SetLastError = true)]
method Hook (line 76) | public Hook(MethodInfo originalMethod, MethodInfo hookMethod)
method Hook (line 104) | public Hook(UnmanagedMethodInfo originalMethod, UnmanagedMethodInfo hook...
method Hook (line 128) | public Hook(UnmanagedMethodInfo originalMethod, MethodInfo hookMethod)
method Hook (line 155) | public Hook(MethodInfo originalMethod, UnmanagedMethodInfo hookMethod)
FILE: DotDumper/Hooks/HookManager.cs
class HookManager (line 13) | class HookManager
method AddHook (line 25) | private static void AddHook(MethodInfo original, MethodInfo hook)
method AddHook (line 30) | private static void AddHook(UnmanagedMethodInfo original, UnmanagedMet...
method AddHook (line 35) | private static void AddHook(UnmanagedMethodInfo original, MethodInfo h...
method AddHook (line 40) | private static void AddHook(MethodInfo original, UnmanagedMethodInfo h...
method AddHook (line 45) | private static void AddHook(Hook hook)
method Initialise (line 80) | public static void Initialise()
method GetMethodInfo (line 518) | public static MethodInfo GetMethodInfo(Type type, string name, List<st...
method LogHooks (line 574) | private static void LogHooks()
method HookAll (line 596) | public static void HookAll()
method UnHookAll (line 607) | public static void UnHookAll()
method HookByHookName (line 620) | public static bool HookByHookName(string hookName)
method UnHookByHookName (line 638) | public static bool UnHookByHookName(string hookName)
FILE: DotDumper/Hooks/InteropFunctions.cs
class InteropFunctions (line 6) | class InteropFunctions
type PROCESS_INFORMATION (line 9) | [StructLayout(LayoutKind.Sequential, Pack = 1)]
type STARTUP_INFORMATION (line 18) | [StructLayout(LayoutKind.Sequential, Pack = 1)]
type SECURITY_ATTRIBUTES (line 33) | [StructLayout(LayoutKind.Sequential, Pack = 1)]
type SystemTime (line 44) | public struct SystemTime
method WriteProcessMemory (line 58) | [DllImport("kernel32.dll", SetLastError = true)]
method GetProcessId (line 61) | [DllImport("kernel32.dll", SetLastError = true)]
method LoadLibrary (line 64) | [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
method VirtualAlloc (line 67) | [DllImport("kernel32.dll")]
method VirtualAllocEx (line 70) | [DllImport("kernel32.dll")]
method ReadProcessMemory (line 73) | [DllImport("kernel32.dll")]
method Wow64SetThreadContext (line 76) | [DllImport("kernel32.dll")]
method SetThreadContext (line 79) | [DllImport("kernel32.dll")]
method Wow64GetThreadContext (line 82) | [DllImport("kernel32.dll")]
method GetThreadContext (line 85) | [DllImport("kernel32.dll")]
method CreateProcessA (line 88) | [DllImport("kernel32.dll", CharSet = CharSet.Ansi)]
method CreateProcessW (line 91) | [DllImport("kernel32.dll", CharSet = CharSet.Unicode)]
method ResumeThread (line 94) | [DllImport("kernel32.dll")]
method VirtualProtect (line 97) | [DllImport("kernel32.dll", SetLastError = true)]
method VirtualProtectEx (line 100) | [DllImport("kernel32.dll", SetLastError = true)]
method GetProcAddress (line 103) | [DllImport("kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
method GetModuleHandle (line 106) | [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
method SetSystemTime (line 114) | [DllImport("kernel32.dll", EntryPoint = "SetSystemTime", SetLastError ...
method NtUnmapViewOfSection (line 119) | [DllImport("ntdll.dll")]
method MessageBoxW (line 124) | [DllImport("user32.dll", CharSet = CharSet.Unicode)]
FILE: DotDumper/Hooks/OriginalManagedFunctions.cs
class OriginalManagedFunctions (line 15) | class OriginalManagedFunctions
method ResourceManagerGetObjectString (line 22) | public static MethodInfo ResourceManagerGetObjectString()
method ResourceManagerGetObjectStringCultureInfo (line 35) | public static MethodInfo ResourceManagerGetObjectStringCultureInfo()
method ResourceManagerGetStringString (line 49) | public static MethodInfo ResourceManagerGetStringString()
method ResourceManagerGetStringStringCultureInfo (line 62) | public static MethodInfo ResourceManagerGetStringStringCultureInfo()
method ResourceManagerGetStreamString (line 76) | public static MethodInfo ResourceManagerGetStreamString()
method ResourceManagerGetStreamStringCultureInfo (line 89) | public static MethodInfo ResourceManagerGetStreamStringCultureInfo()
method EnvironmentExitInt (line 105) | public static MethodInfo EnvironmentExitInt()
method EnvironmentExpandEnvironmentVariablesString (line 118) | public static MethodInfo EnvironmentExpandEnvironmentVariablesString()
method EnvironmentFailFastStringException (line 131) | public static MethodInfo EnvironmentFailFastStringException()
method EnvironmentFailFastString (line 145) | public static MethodInfo EnvironmentFailFastString()
method EnvironmentGetCommandLineArgs (line 158) | public static MethodInfo EnvironmentGetCommandLineArgs()
method EnvironmentGetEnvironmentVariableStringEnvironmentVariableTarget (line 170) | public static MethodInfo EnvironmentGetEnvironmentVariableStringEnviro...
method EnvironmentGetEnvironmentVariableString (line 184) | public static MethodInfo EnvironmentGetEnvironmentVariableString()
method EnvironmentGetEnvironmentVariablesEnvironmentVariableTarget (line 197) | public static MethodInfo EnvironmentGetEnvironmentVariablesEnvironment...
method EnvironmentGetEnvironmentVariables (line 210) | public static MethodInfo EnvironmentGetEnvironmentVariables()
method EnvironmentGetFolderPathSpecialFolderSpecialFolderOption (line 222) | public static MethodInfo EnvironmentGetFolderPathSpecialFolderSpecialF...
method EnvironmentGetFolderPathSpecialFolder (line 236) | public static MethodInfo EnvironmentGetFolderPathSpecialFolder()
method EnvironmentGetLogicalDrives (line 249) | public static MethodInfo EnvironmentGetLogicalDrives()
method EnvironmentSetEnvironmentVariableStringStringEnvironmentVariableTarget (line 261) | public static MethodInfo EnvironmentSetEnvironmentVariableStringString...
method EnvironmentSetEnvironmentVariableStringString (line 276) | public static MethodInfo EnvironmentSetEnvironmentVariableStringString()
method EnvironmentGetResourceFromDefaultString (line 290) | public static MethodInfo EnvironmentGetResourceFromDefaultString()
method ThreadSleepInt (line 305) | public static MethodInfo ThreadSleepInt()
method ThreadSleepTimeSpan (line 318) | public static MethodInfo ThreadSleepTimeSpan()
method PathChangeExtensionStringString (line 333) | public static MethodInfo PathChangeExtensionStringString()
method PathCombineStringString (line 347) | public static MethodInfo PathCombineStringString()
method PathCombineStringStringString (line 361) | public static MethodInfo PathCombineStringStringString()
method PathCombineStringStringStringString (line 376) | public static MethodInfo PathCombineStringStringStringString()
method PathCombineStringArray (line 392) | public static MethodInfo PathCombineStringArray()
method PathGetDirectoryNameString (line 405) | public static MethodInfo PathGetDirectoryNameString()
method PathGetExtensionString (line 418) | public static MethodInfo PathGetExtensionString()
method PathGetFileNameString (line 431) | public static MethodInfo PathGetFileNameString()
method PathGetFileNameWithoutExtensionString (line 444) | public static MethodInfo PathGetFileNameWithoutExtensionString()
method PathGetFullPathString (line 457) | public static MethodInfo PathGetFullPathString()
method PathGetPathRootString (line 470) | public static MethodInfo PathGetPathRootString()
method PathGetRandomFileName (line 483) | public static MethodInfo PathGetRandomFileName()
method PathGetTempFileName (line 495) | public static MethodInfo PathGetTempFileName()
method PathGetTempPath (line 507) | public static MethodInfo PathGetTempPath()
method FileAppendAllLinesStringIenumerableString (line 521) | public static MethodInfo FileAppendAllLinesStringIenumerableString()
method FileAppendAllLinesStringIenumerableStringEncoding (line 535) | public static MethodInfo FileAppendAllLinesStringIenumerableStringEnco...
method FileAppendAllTextStringStringEncoding (line 550) | public static MethodInfo FileAppendAllTextStringStringEncoding()
method FileAppendAllTextStringString (line 565) | public static MethodInfo FileAppendAllTextStringString()
method FileAppendTextString (line 579) | public static MethodInfo FileAppendTextString()
method FileCopyStringString (line 592) | public static MethodInfo FileCopyStringString()
method FileCopyStringStringBoolean (line 606) | public static MethodInfo FileCopyStringStringBoolean()
method FileCreateString (line 621) | public static MethodInfo FileCreateString()
method FileCreateStringInt (line 634) | public static MethodInfo FileCreateStringInt()
method FileCreateStringIntFileOptions (line 648) | public static MethodInfo FileCreateStringIntFileOptions()
method FileCreateStringIntFileOptionsFileSecurity (line 663) | public static MethodInfo FileCreateStringIntFileOptionsFileSecurity()
method FileCreateTextString (line 679) | public static MethodInfo FileCreateTextString()
method FileDecryptString (line 692) | public static MethodInfo FileDecryptString()
method FileDeleteString (line 705) | public static MethodInfo FileDeleteString()
method FileEncryptString (line 718) | public static MethodInfo FileEncryptString()
method FileExiststString (line 731) | public static MethodInfo FileExiststString()
method FileMoveStringString (line 744) | public static MethodInfo FileMoveStringString()
method FileOpenStringFileModeFileAccessFileShare (line 758) | public static MethodInfo FileOpenStringFileModeFileAccessFileShare()
method FileOpenStringFileMode (line 774) | public static MethodInfo FileOpenStringFileMode()
method FileOpenStringFileModeFileAccess (line 788) | public static MethodInfo FileOpenStringFileModeFileAccess()
method FileOpenReadString (line 803) | public static MethodInfo FileOpenReadString()
method FileOpenTextString (line 816) | public static MethodInfo FileOpenTextString()
method FileOpenWriteString (line 829) | public static MethodInfo FileOpenWriteString()
method FileReadAllLinesStringEncoding (line 842) | public static MethodInfo FileReadAllLinesStringEncoding()
method FileReadAllLinesString (line 856) | public static MethodInfo FileReadAllLinesString()
method FileReadAllTextString (line 869) | public static MethodInfo FileReadAllTextString()
method FileReadAllTextStringEncoding (line 882) | public static MethodInfo FileReadAllTextStringEncoding()
method FileReadLinesStringEncoding (line 896) | public static MethodInfo FileReadLinesStringEncoding()
method FileReadLinesString (line 910) | public static MethodInfo FileReadLinesString()
method FileReplaceStringStringString (line 923) | public static MethodInfo FileReplaceStringStringString()
method FileReplaceStringStringStringBoolean (line 938) | public static MethodInfo FileReplaceStringStringStringBoolean()
method FileSetAccessControlStringFileSecurity (line 954) | public static MethodInfo FileSetAccessControlStringFileSecurity()
method FileSetAttributesStringFileAttributes (line 968) | public static MethodInfo FileSetAttributesStringFileAttributes()
method FileWriteAllBytesStringByteArray (line 982) | public static MethodInfo FileWriteAllBytesStringByteArray()
method FileWriteAllLinesStringStringArray (line 996) | public static MethodInfo FileWriteAllLinesStringStringArray()
method FileWriteAllLinesStringStringArrayEncoding (line 1010) | public static MethodInfo FileWriteAllLinesStringStringArrayEncoding()
method FileWriteAllLinesStringIenumerableString (line 1025) | public static MethodInfo FileWriteAllLinesStringIenumerableString()
method FileWriteAllLinesStringIenumerableStringEncoding (line 1039) | public static MethodInfo FileWriteAllLinesStringIenumerableStringEncod...
method FileWriteAllTextStringString (line 1054) | public static MethodInfo FileWriteAllTextStringString()
method FileWriteAllTextStringStringEncoding (line 1068) | public static MethodInfo FileWriteAllTextStringStringEncoding()
method FileReadAllBytesString (line 1083) | public static MethodInfo FileReadAllBytesString()
method ConvertFromBase64StringString (line 1098) | public static MethodInfo ConvertFromBase64StringString()
method ConvertFromBase64CharArrayCharArrayIntInt (line 1111) | public static MethodInfo ConvertFromBase64CharArrayCharArrayIntInt()
method ProcessGetCurrentProcess (line 1128) | public static MethodInfo ProcessGetCurrentProcess()
method ProcessGetProcessByIdIntString (line 1140) | public static MethodInfo ProcessGetProcessByIdIntString()
method ProcessGetProcessByIdInt (line 1154) | public static MethodInfo ProcessGetProcessByIdInt()
method ProcessGetProcesses (line 1167) | public static MethodInfo ProcessGetProcesses()
method ProcessGetProcessesString (line 1179) | public static MethodInfo ProcessGetProcessesString()
method ProcessGetProcessesByNameString (line 1192) | public static MethodInfo ProcessGetProcessesByNameString()
method ProcessGetProcessesByNameStringString (line 1205) | public static MethodInfo ProcessGetProcessesByNameStringString()
method ProcessStartStringString (line 1219) | public static MethodInfo ProcessStartStringString()
method ProcessStartProcessStartInfo (line 1233) | public static MethodInfo ProcessStartProcessStartInfo()
method ProcessStartString (line 1246) | public static MethodInfo ProcessStartString()
method ProcessStartStringStringStringSecureStringString (line 1259) | public static MethodInfo ProcessStartStringStringStringSecureStringStr...
method ProcessStartStringStringSecureStringString (line 1276) | public static MethodInfo ProcessStartStringStringSecureStringString()
method ProcessStart (line 1292) | public static MethodInfo ProcessStart()
method WebClientDownloadDataString (line 1306) | public static MethodInfo WebClientDownloadDataString()
method WebClientDownloadDataUri (line 1319) | public static MethodInfo WebClientDownloadDataUri()
method WebClientDownloadStringString (line 1332) | public static MethodInfo WebClientDownloadStringString()
method WebClientDownloadStringUri (line 1345) | public static MethodInfo WebClientDownloadStringUri()
method WebClientDownloadFileStringString (line 1358) | public static MethodInfo WebClientDownloadFileStringString()
method WebClientDownloadFileUriString (line 1372) | public static MethodInfo WebClientDownloadFileUriString()
method WebClientOpenReadString (line 1386) | public static MethodInfo WebClientOpenReadString()
method WebClientOpenReadUri (line 1399) | public static MethodInfo WebClientOpenReadUri()
method WebClientOpenWriteString (line 1412) | public static MethodInfo WebClientOpenWriteString()
method WebClientOpenWriteStringString (line 1425) | public static MethodInfo WebClientOpenWriteStringString()
method WebClientOpenWriteUri (line 1439) | public static MethodInfo WebClientOpenWriteUri()
method WebClientOpenWriteUriString (line 1452) | public static MethodInfo WebClientOpenWriteUriString()
method WebClientUploadDataUriStringByteArray (line 1466) | public static MethodInfo WebClientUploadDataUriStringByteArray()
method WebClientUploadDataStringStringByteArray (line 1481) | public static MethodInfo WebClientUploadDataStringStringByteArray()
method WebClientUploadDataStringByteArray (line 1496) | public static MethodInfo WebClientUploadDataStringByteArray()
method WebClientUploadDataUriByteArray (line 1510) | public static MethodInfo WebClientUploadDataUriByteArray()
method WebClientUploadFileUriStringString (line 1524) | public static MethodInfo WebClientUploadFileUriStringString()
method WebClientUploadFileStringStringString (line 1539) | public static MethodInfo WebClientUploadFileStringStringString()
method WebClientUploadFileUriString (line 1554) | public static MethodInfo WebClientUploadFileUriString()
method WebClientUploadFileStringString (line 1568) | public static MethodInfo WebClientUploadFileStringString()
method WebClientUploadStringStringString (line 1582) | public static MethodInfo WebClientUploadStringStringString()
method WebClientUploadStringUriString (line 1596) | public static MethodInfo WebClientUploadStringUriString()
method WebClientUploadStringStringStringString (line 1610) | public static MethodInfo WebClientUploadStringStringStringString()
method WebClientUploadStringUriStringString (line 1625) | public static MethodInfo WebClientUploadStringUriStringString()
method WebClientUploadValuesUriStringNameValueCollection (line 1640) | public static MethodInfo WebClientUploadValuesUriStringNameValueCollec...
method WebClientUploadValuesStringStringNameValueCollection (line 1655) | public static MethodInfo WebClientUploadValuesStringStringNameValueCol...
method WebClientUploadValuesUriNameValueCollection (line 1670) | public static MethodInfo WebClientUploadValuesUriNameValueCollection()
method WebClientUploadValuesStringNameValueCollection (line 1684) | public static MethodInfo WebClientUploadValuesStringNameValueCollection()
method TypeInvokeMemberStringBindingFlagsBinderObjectObjectArrayCultureInfo (line 1700) | public static MethodInfo TypeInvokeMemberStringBindingFlagsBinderObjec...
method TypeInvokeMemberStringBindingFlagsBinderObjectObjectArray (line 1718) | public static MethodInfo TypeInvokeMemberStringBindingFlagsBinderObjec...
method MethodBaseInvokeObjectBindingFlagsBinderObjectArrayCultureInfo (line 1737) | public static MethodInfo MethodBaseInvokeObjectBindingFlagsBinderObjec...
method MethodBaseInvokeObjectObjectArray (line 1754) | public static MethodInfo MethodBaseInvokeObjectObjectArray()
method AssemblyGetEntryAssembly (line 1770) | public static MethodInfo AssemblyGetEntryAssembly()
method AssemblyGetExecutingAssembly (line 1782) | public static MethodInfo AssemblyGetExecutingAssembly()
method AssemblyReflectionOnlyLoadFromString (line 1794) | public static MethodInfo AssemblyReflectionOnlyLoadFromString()
method AssemblyUnsafeLoadFromString (line 1807) | public static MethodInfo AssemblyUnsafeLoadFromString()
method AssemblyReflectionOnlyLoadByteArray (line 1820) | public static MethodInfo AssemblyReflectionOnlyLoadByteArray()
method AssemblyReflectionOnlyLoadString (line 1833) | public static MethodInfo AssemblyReflectionOnlyLoadString()
method AssemblyLoadWithPartialNameString (line 1848) | public static MethodInfo AssemblyLoadWithPartialNameString()
method AssemblyLoadWithPartialNameStringEvidence (line 1863) | public static MethodInfo AssemblyLoadWithPartialNameStringEvidence()
method AssemblyLoadFromStringEvidenceByteArrayAssemblyHashAlgorithm (line 1879) | public static MethodInfo AssemblyLoadFromStringEvidenceByteArrayAssemb...
method AssemblyLoadFromStringByteArrayAssemblyHashAlgorithm (line 1895) | public static MethodInfo AssemblyLoadFromStringByteArrayAssemblyHashAl...
method AssemblyLoadFromString (line 1910) | public static MethodInfo AssemblyLoadFromString()
method AssemblyLoadFromStringEvidence (line 1925) | public static MethodInfo AssemblyLoadFromStringEvidence()
method AssemblyLoadFileStringEvidence (line 1941) | public static MethodInfo AssemblyLoadFileStringEvidence()
method AssemblyLoadFileString (line 1955) | public static MethodInfo AssemblyLoadFileString()
method AssemblyLoadByteArrayByteArray (line 1968) | public static MethodInfo AssemblyLoadByteArrayByteArray()
method AssemblyLoadByteArrayByteArraySecurityContextSource (line 1982) | public static MethodInfo AssemblyLoadByteArrayByteArraySecurityContext...
method AssemblyLoadAssemblyNameEvidence (line 1999) | public static MethodInfo AssemblyLoadAssemblyNameEvidence()
method AssemblyLoadAssemblyName (line 2013) | public static MethodInfo AssemblyLoadAssemblyName()
method AssemblyLoadByteArrayByteArrayEvidence (line 2028) | public static MethodInfo AssemblyLoadByteArrayByteArrayEvidence()
method AssemblyLoadStringEvidence (line 2045) | public static MethodInfo AssemblyLoadStringEvidence()
method AssemblyLoadString (line 2059) | public static MethodInfo AssemblyLoadString()
method AssemblyLoadByteArray (line 2072) | public static MethodInfo AssemblyLoadByteArray()
method ConsoleWriteString (line 2087) | public static MethodInfo ConsoleWriteString()
method ConsoleWriteObject (line 2100) | public static MethodInfo ConsoleWriteObject()
method ConsoleWriteUlong (line 2113) | public static MethodInfo ConsoleWriteUlong()
method ConsoleWriteLong (line 2126) | public static MethodInfo ConsoleWriteLong()
method ConsoleWriteInt (line 2139) | public static MethodInfo ConsoleWriteInt()
method ConsoleWriteUint (line 2152) | public static MethodInfo ConsoleWriteUint()
method ConsoleWriteBool (line 2165) | public static MethodInfo ConsoleWriteBool()
method ConsoleWriteChar (line 2178) | public static MethodInfo ConsoleWriteChar()
method ConsoleWriteDecimal (line 2191) | public static MethodInfo ConsoleWriteDecimal()
method ConsoleWriteFloat (line 2204) | public static MethodInfo ConsoleWriteFloat()
method ConsoleWriteDouble (line 2217) | public static MethodInfo ConsoleWriteDouble()
method ConsoleWriteStringObject (line 2230) | public static MethodInfo ConsoleWriteStringObject()
method ConsoleWriteStringObjectObject (line 2244) | public static MethodInfo ConsoleWriteStringObjectObject()
method ConsoleWriteStringObjectObjectObject (line 2259) | public static MethodInfo ConsoleWriteStringObjectObjectObject()
method ConsoleWriteStringObjectObjectObjectObject (line 2275) | public static MethodInfo ConsoleWriteStringObjectObjectObjectObject()
method ConsoleWriteStringObjectArray (line 2292) | public static MethodInfo ConsoleWriteStringObjectArray()
method ConsoleWriteCharArray (line 2306) | public static MethodInfo ConsoleWriteCharArray()
method ConsoleWriteCharArrayIntInt (line 2319) | public static MethodInfo ConsoleWriteCharArrayIntInt()
method ConsoleWriteLine (line 2334) | public static MethodInfo ConsoleWriteLine()
method ConsoleWriteLineFloat (line 2346) | public static MethodInfo ConsoleWriteLineFloat()
method ConsoleWriteLineInt (line 2359) | public static MethodInfo ConsoleWriteLineInt()
method ConsoleWriteLineUint (line 2372) | public static MethodInfo ConsoleWriteLineUint()
method ConsoleWriteLineLong (line 2385) | public static MethodInfo ConsoleWriteLineLong()
method ConsoleWriteLineUlong (line 2398) | public static MethodInfo ConsoleWriteLineUlong()
method ConsoleWriteLineObject (line 2411) | public static MethodInfo ConsoleWriteLineObject()
method ConsoleWriteLineString (line 2424) | public static MethodInfo ConsoleWriteLineString()
method ConsoleWriteLineDecimal (line 2437) | public static MethodInfo ConsoleWriteLineDecimal()
method ConsoleWriteLineCharArray (line 2450) | public static MethodInfo ConsoleWriteLineCharArray()
method ConsoleWriteLineChar (line 2463) | public static MethodInfo ConsoleWriteLineChar()
method ConsoleWriteLineBool (line 2476) | public static MethodInfo ConsoleWriteLineBool()
method ConsoleWriteLineDouble (line 2489) | public static MethodInfo ConsoleWriteLineDouble()
method ConsoleWriteLineStringObject (line 2502) | public static MethodInfo ConsoleWriteLineStringObject()
method ConsoleWriteLineStringObjectObject (line 2516) | public static MethodInfo ConsoleWriteLineStringObjectObject()
method ConsoleWriteLineStringObjectObjectObject (line 2531) | public static MethodInfo ConsoleWriteLineStringObjectObjectObject()
method ConsoleWriteLineStringObjectObjectObjectObject (line 2547) | public static MethodInfo ConsoleWriteLineStringObjectObjectObjectObject()
method ConsoleWriteLineStringObjectArray (line 2564) | public static MethodInfo ConsoleWriteLineStringObjectArray()
method ConsoleWriteLineCharArrayIntInt (line 2578) | public static MethodInfo ConsoleWriteLineCharArrayIntInt()
method ActivatorCreateComInstanceFromStringStringByteArrayAssemblyHashAlgorithm (line 2595) | public static MethodInfo ActivatorCreateComInstanceFromStringStringByt...
method ActivatorCreateComInstanceFromStringString (line 2611) | public static MethodInfo ActivatorCreateComInstanceFromStringString()
method ActivatorCreateInstanceTypeBool (line 2625) | public static MethodInfo ActivatorCreateInstanceTypeBool()
method ActivatorCreateInstanceType (line 2639) | public static MethodInfo ActivatorCreateInstanceType()
method ActivatorCreateInstanceActivationContext (line 2652) | public static MethodInfo ActivatorCreateInstanceActivationContext()
method ActivatorCreateInstanceStringString (line 2665) | public static MethodInfo ActivatorCreateInstanceStringString()
method ActivatorCreateInstanceTypeObjectArray (line 2679) | public static MethodInfo ActivatorCreateInstanceTypeObjectArray()
method ActivatorCreateInstanceTypeBindingFlagsBinderObjectArrayCultureInfo (line 2693) | public static MethodInfo ActivatorCreateInstanceTypeBindingFlagsBinder...
method ActivatorCreateInstanceTypeBindingFlagsBinderObjectArrayCultureInfoObjectArray (line 2710) | public static MethodInfo ActivatorCreateInstanceTypeBindingFlagsBinder...
method ActivatorCreateInstanceStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArray (line 2728) | public static MethodInfo ActivatorCreateInstanceStringStringBooleanBin...
method ActivatorCreateInstanceActivationContextStringArray (line 2748) | public static MethodInfo ActivatorCreateInstanceActivationContextStrin...
method ActivatorCreateInstanceStringStringObjectArray (line 2762) | public static MethodInfo ActivatorCreateInstanceStringStringObjectArray()
method ActivatorCreateInstanceAppDomainStringString (line 2777) | public static MethodInfo ActivatorCreateInstanceAppDomainStringString()
method ActivatorCreateInstanceStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence (line 2792) | public static MethodInfo ActivatorCreateInstanceStringStringBooleanBin...
method ActivatorCreateInstanceAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArray (line 2813) | public static MethodInfo ActivatorCreateInstanceAppDomainStringStringB...
method ActivatorCreateInstanceAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence (line 2834) | public static MethodInfo ActivatorCreateInstanceAppDomainStringStringB...
method ActivatorCreateInstanceFromAppDomainStringString (line 2856) | public static MethodInfo ActivatorCreateInstanceFromAppDomainStringStr...
method ActivatorCreateInstanceFromStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence (line 2871) | public static MethodInfo ActivatorCreateInstanceFromStringStringBoolea...
method ActivatorCreateInstanceFromAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArray (line 2892) | public static MethodInfo ActivatorCreateInstanceFromAppDomainStringStr...
method ActivatorCreateInstanceFromAppDomainStringStringBooleanBindingFlagsBinderObjectArrayCultureInfoObjectArrayEvidence (line 2913) | public static MethodInfo ActivatorCreateInstanceFromAppDomainStringStr...
method ActivatorCreateInstanceFromStringString (line 2935) | public static MethodInfo ActivatorCreateInstanceFromStringString()
method ActivatorCreateInstanceFromStringStringObjectArray (line 2949) | public static MethodInfo ActivatorCreateInstanceFromStringStringObject...
method ActivatorCreateInstanceFromStringStringBoolBindingFlagsBinderObjectArrayCultureInfoObjectArray (line 2964) | public static MethodInfo ActivatorCreateInstanceFromStringStringBoolBi...
FILE: DotDumper/Hooks/OriginalUnmanagedFunctions.cs
class OriginalUnmanagedFunctions (line 9) | class OriginalUnmanagedFunctions
method Kernel32WriteProcessMemory (line 16) | public static UnmanagedMethodInfo Kernel32WriteProcessMemory()
method Kernel32CreateProcessA (line 34) | public static UnmanagedMethodInfo Kernel32CreateProcessA()
method Kernel32CreateProcessW (line 57) | public static UnmanagedMethodInfo Kernel32CreateProcessW()
method User32MessageBoxW (line 82) | public static UnmanagedMethodInfo User32MessageBoxW()
method NtdllZwMapViewOfSection (line 101) | public static UnmanagedMethodInfo NtdllZwMapViewOfSection()
FILE: DotDumper/Logger.cs
class Logger (line 16) | class Logger
method Logger (line 51) | public Logger()
method LogSampleCall (line 96) | public void LogSampleCall(int stackTraceOffset, MethodBase method, obj...
method Log (line 125) | public void Log(int stackTraceOffset, MethodBase method, object[] para...
method Log (line 145) | public void Log(LogEntry entry, bool ignoreHooks, bool periodicDump)
method LogEntry2HumanReadablePlaintext (line 210) | private string LogEntry2HumanReadablePlaintext(LogEntry entry)
FILE: DotDumper/Models/Argument.cs
class Argument (line 8) | public class Argument
method Argument (line 37) | public Argument(string type, string name, string value, List<Hash> rel...
method Argument (line 48) | public Argument()
FILE: DotDumper/Models/AssemblyObject.cs
class AssemblyObject (line 6) | public class AssemblyObject
method AssemblyObject (line 23) | public AssemblyObject(string hash, string name)
method AssemblyObject (line 32) | public AssemblyObject()
FILE: DotDumper/Models/Hash.cs
class Hash (line 6) | public class Hash
method Hash (line 59) | public Hash(string md5, string sha1, string sha256, string sha384, str...
method Hash (line 74) | public Hash()
FILE: DotDumper/Models/LogEntry.cs
class LogEntry (line 10) | public class LogEntry
method LogEntry (line 86) | public LogEntry(string originatingAssemblyName, Hash originatingAssemb...
method LogEntry (line 105) | public LogEntry()
method GetDateTime (line 114) | private static string GetDateTime()
FILE: DotDumper/Models/UnmanagedMethodInfo.cs
class UnmanagedMethodInfo (line 10) | class UnmanagedMethodInfo
method UnmanagedMethodInfo (line 45) | public UnmanagedMethodInfo(string dll, string fullMethodName, string m...
method GetPointer (line 60) | private IntPtr GetPointer(string dll, string methodName)
FILE: DotDumper/Pipes/PipeManager.cs
class PipeManager (line 13) | class PipeManager
method Initialise (line 28) | public static void Initialise()
method HandlePipeCalls (line 45) | public static void HandlePipeCalls()
method HandleMessageBoxW (line 126) | private static LogEntry HandleMessageBoxW()
method HandleWriteProcessMemory (line 133) | private static LogEntry HandleWriteProcessMemory()
method HandleCreateProcessA (line 161) | private static LogEntry HandleCreateProcessA()
method HandleCreateProcessW (line 178) | private static LogEntry HandleCreateProcessW()
method GetBufferFromPipe (line 199) | private static byte[] GetBufferFromPipe()
method GetSubArray (line 216) | private static byte[] GetSubArray(byte[] buffer, int index, int count)
FILE: DotDumper/Program.cs
class Program (line 13) | class Program
method Main (line 25) | static void Main(string[] args)
Condensed preview — 193 files, each showing path, character count, and a content snippet. Download the .json file or copy for the full structured content (5,278K chars).
[
{
"path": "DotDumper/ArgumentHandler.cs",
"chars": 38617,
"preview": "using System;\r\nusing System.IO;\r\nusing System.Reflection;\r\n\r\nnamespace DotDumper\r\n{\r\n /// <summary>\r\n /// This cl"
},
{
"path": "DotDumper/Config.cs",
"chars": 2738,
"preview": "namespace DotDumper\r\n{\r\n /// <summary>\r\n /// This class contains the default configuration values. Fields are ove"
},
{
"path": "DotDumper/DotDumper.csproj",
"chars": 8211,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<Project ToolsVersion=\"15.0\" xmlns=\"http://schemas.microsoft.com/developer/msbu"
},
{
"path": "DotDumper/Helpers/ArgumentHelper.cs",
"chars": 13009,
"preview": "using System;\r\nusing System.Collections;\r\nusing System.Collections.Generic;\r\nusing System.Linq;\r\nusing System.Reflectio"
},
{
"path": "DotDumper/Helpers/AssemblyMapper.cs",
"chars": 9810,
"preview": "using System;\r\nusing System.Collections.Generic;\r\nusing System.Reflection;\r\nusing DotDumper.HookHandlers;\r\nusing DotDum"
},
{
"path": "DotDumper/Helpers/Hashes.cs",
"chars": 6736,
"preview": "using System.Linq;\r\nusing System.Security.Cryptography;\r\nusing DotDumper.Hooks;\r\nusing PeNet;\r\n\r\nnamespace DotDumper.He"
},
{
"path": "DotDumper/Helpers/LogEntryHelper.cs",
"chars": 9231,
"preview": "using System;\r\nusing System.Collections.Generic;\r\nusing System.Reflection;\r\nusing DotDumper.HookHandlers;\r\nusing DotDum"
},
{
"path": "DotDumper/Helpers/MissedAssemblyDumper.cs",
"chars": 7265,
"preview": "using System;\r\nusing System.Collections.Generic;\r\nusing System.Reflection;\r\nusing DotDumper.HookHandlers;\r\nusing DotDum"
},
{
"path": "DotDumper/Helpers/RaceConditionHandler.cs",
"chars": 2560,
"preview": "using System.Threading;\r\nusing DotDumper.Hooks;\r\nusing System;\r\nusing System.Collections.Generic;\r\n\r\nnamespace DotDumpe"
},
{
"path": "DotDumper/Helpers/Serialise.cs",
"chars": 4604,
"preview": "using System.IO;\r\nusing System.Reflection;\r\nusing System.Web.Script.Serialization;\r\nusing System.Xml.Serialization;\r\nus"
},
{
"path": "DotDumper/Helpers/StagnationHandler.cs",
"chars": 4447,
"preview": "using System;\r\nusing DotDumper.HookHandlers;\r\nusing DotDumper.Hooks;\r\nusing DotDumper.Models;\r\n\r\nnamespace DotDumper.He"
},
{
"path": "DotDumper/HookHandlers/Activator/ActivatorHooks.cs",
"chars": 32971,
"preview": "using System;\r\nusing System.Configuration.Assemblies;\r\nusing System.Globalization;\r\nusing System.Reflection;\r\nusing Sys"
},
{
"path": "DotDumper/HookHandlers/Assembly/AssemblyHooks.cs",
"chars": 23107,
"preview": "using System.Configuration.Assemblies;\r\nusing System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System."
},
{
"path": "DotDumper/HookHandlers/Console/ConsoleHooks.cs",
"chars": 19567,
"preview": "using System;\r\nusing System.Runtime.CompilerServices;\r\nusing DotDumper.Hooks;\r\n\r\nnamespace DotDumper.HookHandlers\r\n{\r\n "
},
{
"path": "DotDumper/HookHandlers/Convert/ConvertHooks.cs",
"chars": 2324,
"preview": "using System;\r\nusing System.Runtime.CompilerServices;\r\nusing DotDumper.Hooks;\r\n\r\nnamespace DotDumper.HookHandlers\r\n{\r\n "
},
{
"path": "DotDumper/HookHandlers/Directory/DirectoryHooks.cs",
"chars": 81,
"preview": "namespace DotDumper.HookHandlers\r\n{\r\n class DirectoryHooks\r\n {\r\n }\r\n}\r\n"
},
{
"path": "DotDumper/HookHandlers/Environment/EnvironmentHooks.cs",
"chars": 15894,
"preview": "using System;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Collections;\r\nusing static System.Environment;\r\nusi"
},
{
"path": "DotDumper/HookHandlers/File/FileHooks.cs",
"chars": 39847,
"preview": "using System.Collections.Generic;\r\nusing System.IO;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Security.Acce"
},
{
"path": "DotDumper/HookHandlers/GenericHookHelper.cs",
"chars": 12087,
"preview": "using System;\r\nusing System.Collections.Generic;\r\nusing System.Reflection;\r\nusing System.Security.Policy;\r\nusing System"
},
{
"path": "DotDumper/HookHandlers/MethodBase/MethodBaseHooks.cs",
"chars": 1168,
"preview": "using System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing DotDumper.Helpers;\r\n\r\nnamespace DotDumper.HookH"
},
{
"path": "DotDumper/HookHandlers/Path/PathHooks.cs",
"chars": 14690,
"preview": "using System.IO;\r\nusing System.Runtime.CompilerServices;\r\nusing DotDumper.Hooks;\r\n\r\nnamespace DotDumper.HookHandlers\r\n{"
},
{
"path": "DotDumper/HookHandlers/Process/ProcessHooks.cs",
"chars": 12425,
"preview": "using System.Diagnostics;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Security;\r\nusing DotDumper.Hooks;\r\n\r\nna"
},
{
"path": "DotDumper/HookHandlers/ResourceManager/ResourceManagerHooks.cs",
"chars": 10943,
"preview": "using System;\r\nusing System.Globalization;\r\nusing System.IO;\r\nusing System.Reflection;\r\nusing System.Resources;\r\nusing "
},
{
"path": "DotDumper/HookHandlers/Thread/ThreadHooks.cs",
"chars": 2224,
"preview": "using System;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Threading;\r\nusing DotDumper.Hooks;\r\n\r\nnamespace Dot"
},
{
"path": "DotDumper/HookHandlers/Type/TypeHooks.cs",
"chars": 2822,
"preview": "using System;\r\nusing System.Globalization;\r\nusing System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing Dot"
},
{
"path": "DotDumper/HookHandlers/Type/TypeHooksHelper.cs",
"chars": 2968,
"preview": "using System;\r\nusing System.Globalization;\r\nusing System.Reflection;\r\nusing DotDumper.Helpers;\r\nusing DotDumper.Hooks;\r"
},
{
"path": "DotDumper/Hooks/Hook.cs",
"chars": 19711,
"preview": "using System;\r\nusing System.Reflection;\r\nusing System.Runtime.CompilerServices;\r\nusing System.Runtime.InteropServices;\r"
},
{
"path": "DotDumper/Hooks/HookManager.cs",
"chars": 42417,
"preview": "using System;\r\nusing System.Collections.Generic;\r\nusing System.IO;\r\nusing System.Reflection;\r\nusing DotDumper.HookHandl"
},
{
"path": "DotDumper/Hooks/InteropFunctions.cs",
"chars": 5519,
"preview": "using System;\r\nusing System.Runtime.InteropServices;\r\n\r\nnamespace DotDumper.Hooks\r\n{\r\n class InteropFunctions\r\n {"
},
{
"path": "DotDumper/Hooks/OriginalManagedFunctions.cs",
"chars": 125333,
"preview": "using System;\r\nusing System.Collections.Generic;\r\nusing System.Diagnostics;\r\nusing System.IO;\r\nusing System.Net;\r\nusing"
},
{
"path": "DotDumper/Hooks/OriginalUnmanagedFunctions.cs",
"chars": 6616,
"preview": "using System.Collections.Generic;\r\nusing DotDumper.Models;\r\n\r\nnamespace DotDumper.Hooks\r\n{\r\n /// <summary>\r\n /// "
},
{
"path": "DotDumper/Logger.cs",
"chars": 20410,
"preview": "using System;\r\nusing System.Collections.Generic;\r\nusing System.IO;\r\nusing System.Reflection;\r\nusing System.Text;\r\nusing"
},
{
"path": "DotDumper/Models/Argument.cs",
"chars": 2209,
"preview": "using System.Collections.Generic;\r\n\r\nnamespace DotDumper.Models\r\n{\r\n /// <summary>\r\n /// This class is used to st"
},
{
"path": "DotDumper/Models/AssemblyObject.cs",
"chars": 1179,
"preview": "namespace DotDumper.Models\r\n{\r\n /// <summary>\r\n /// An object to reference Assembly objects, based on a SHA-256 h"
},
{
"path": "DotDumper/Models/Hash.cs",
"chars": 2871,
"preview": "namespace DotDumper.Models\r\n{\r\n /// <summary>\r\n /// A model to contain the MD-5, SHA-1, and SHA-256 hash for a gi"
},
{
"path": "DotDumper/Models/LogEntry.cs",
"chars": 6144,
"preview": "using System;\r\nusing System.Collections.Generic;\r\nusing DotDumper.Hooks;\r\n\r\nnamespace DotDumper.Models\r\n{\r\n /// <sum"
},
{
"path": "DotDumper/Models/UnmanagedMethodInfo.cs",
"chars": 3135,
"preview": "using System;\r\nusing System.Collections.Generic;\r\nusing DotDumper.Hooks;\r\n\r\nnamespace DotDumper.Models\r\n{\r\n /// <sum"
},
{
"path": "DotDumper/Pipes/PipeManager.cs",
"chars": 11323,
"preview": "using System;\r\nusing System.IO;\r\nusing System.IO.Pipes;\r\nusing System.Text;\r\nusing System.Threading;\r\nusing DotDumper.H"
},
{
"path": "DotDumper/Program.cs",
"chars": 6760,
"preview": "using System;\r\nusing System.Reflection;\r\nusing DotDumper.Hooks;\r\nusing DotDumper.HookHandlers;\r\nusing System.Collection"
},
{
"path": "DotDumper/Properties/AssemblyInfo.cs",
"chars": 1382,
"preview": "using System.Reflection;\r\nusing System.Runtime.InteropServices;\r\n\r\n// General Information about an assembly is controll"
},
{
"path": "DotDumper/app.config",
"chars": 882,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<configuration>\r\n\t<!--The startup field sets the required .NET Framework versio"
},
{
"path": "DotDumper/bin/Debug/DotDumper.exe.config",
"chars": 882,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<configuration>\r\n\t<!--The startup field sets the required .NET Framework versio"
},
{
"path": "DotDumper/bin/Debug/System.Buffers.xml",
"chars": 3479,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?><doc>\r\n <assembly>\r\n <name>System.Buffers</name>\r\n </assembly>\r\n <members>\r"
},
{
"path": "DotDumper/bin/Debug/System.Memory.xml",
"chars": 13948,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?><doc>\r\n <assembly>\r\n <name>System.Memory</name>\r\n </assembly>\r\n <members>\r\n"
},
{
"path": "DotDumper/bin/Debug/System.Numerics.Vectors.xml",
"chars": 183482,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?><doc>\r\n <assembly>\r\n <name>System.Numerics.Vectors</name>\r\n </assembly>\r\n <"
},
{
"path": "DotDumper/bin/Debug/System.Runtime.CompilerServices.Unsafe.xml",
"chars": 20527,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Runtime.CompilerServices.Unsafe</name>\r\n "
},
{
"path": "DotDumper/bin/Debug/System.Security.Cryptography.Pkcs.xml",
"chars": 11026,
"preview": "<?xml version=\"1.0\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Security.Cryptography.Pkcs</name>\r\n </assembly>\r\n "
},
{
"path": "DotDumper/obj/Debug/.NETFramework,Version=v4.7.2.AssemblyAttributes.cs",
"chars": 214,
"preview": "// <autogenerated />\r\nusing System;\r\nusing System.Reflection;\r\n[assembly: global::System.Runtime.Versioning.TargetFramew"
},
{
"path": "DotDumper/obj/Debug/.NETFramework,Version=v4.8.AssemblyAttributes.cs",
"chars": 210,
"preview": "// <autogenerated />\r\nusing System;\r\nusing System.Reflection;\r\n[assembly: global::System.Runtime.Versioning.TargetFramew"
},
{
"path": "DotDumper/obj/Debug/DotDumper.csproj.CopyComplete",
"chars": 0,
"preview": ""
},
{
"path": "DotDumper/obj/Debug/DotDumper.csproj.CoreCompileInputs.cache",
"chars": 42,
"preview": "4714cd6333f629bfd5df722447dbb1fbbbb252a5\r\n"
},
{
"path": "DotDumper/obj/Debug/DotDumper.csproj.FileListAbsolute.txt",
"chars": 1666,
"preview": "C:\\Users\\John\\Source\\Repos\\DotDumper\\DotDumper\\bin\\Debug\\DotDumper.exe.config\r\nC:\\Users\\John\\Source\\Repos\\DotDumper\\DotD"
},
{
"path": "DotDumper/obj/x64/Debug/.NETFramework,Version=v4.7.2.AssemblyAttributes.cs",
"chars": 214,
"preview": "// <autogenerated />\r\nusing System;\r\nusing System.Reflection;\r\n[assembly: global::System.Runtime.Versioning.TargetFramew"
},
{
"path": "DotDumper/obj/x64/Debug/DotDumper.csproj.CoreCompileInputs.cache",
"chars": 42,
"preview": "395ac2255130d4132da537b24d372ccbfe91101e\r\n"
},
{
"path": "DotDumper/obj/x64/Debug/DotDumper.csproj.FileListAbsolute.txt",
"chars": 510,
"preview": "C:\\Users\\John\\Source\\Repos\\DotDumper\\DotDumper\\bin\\x64\\Debug\\DotDumper.exe\r\nC:\\Users\\John\\Source\\Repos\\DotDumper\\DotDump"
},
{
"path": "DotDumper/packages.config",
"chars": 714,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<packages>\r\n <package id=\"PeNet\" version=\"2.9.9\" targetFramework=\"net48\" />\r\n "
},
{
"path": "DotDumper.sln",
"chars": 1485,
"preview": "\r\nMicrosoft Visual Studio Solution File, Format Version 12.00\r\n# Visual Studio Version 16\r\nVisualStudioVersion = 16.0.2"
},
{
"path": "LICENSE",
"chars": 13145,
"preview": "DotDumper's code, unless otherwise stated, is licensed under the Apache 2.0 License.\n\nThe PENet library (licensed under "
},
{
"path": "README.md",
"chars": 17133,
"preview": "<img src=\"images/DotDumper.png\" alt=\"The DotDumper logo, a dumping truck\" width=\"610\" height=\"414\" />\n\n# DotDumper\nAn au"
},
{
"path": "packages/System.Buffers.4.5.1/LICENSE.TXT",
"chars": 1139,
"preview": "The MIT License (MIT)\r\n\r\nCopyright (c) .NET Foundation and Contributors\r\n\r\nAll rights reserved.\r\n\r\nPermission is hereby "
},
{
"path": "packages/System.Buffers.4.5.1/THIRD-PARTY-NOTICES.TXT",
"chars": 15829,
"preview": ".NET Core uses third-party libraries or other resources that may be\r\ndistributed under licenses different than the .NET "
},
{
"path": "packages/System.Buffers.4.5.1/lib/net461/System.Buffers.xml",
"chars": 3479,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?><doc>\r\n <assembly>\r\n <name>System.Buffers</name>\r\n </assembly>\r\n <members>\r"
},
{
"path": "packages/System.Buffers.4.5.1/lib/netcoreapp2.0/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Buffers.4.5.1/lib/netstandard1.1/System.Buffers.xml",
"chars": 3479,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?><doc>\r\n <assembly>\r\n <name>System.Buffers</name>\r\n </assembly>\r\n <members>\r"
},
{
"path": "packages/System.Buffers.4.5.1/lib/netstandard2.0/System.Buffers.xml",
"chars": 3479,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?><doc>\r\n <assembly>\r\n <name>System.Buffers</name>\r\n </assembly>\r\n <members>\r"
},
{
"path": "packages/System.Buffers.4.5.1/lib/uap10.0.16299/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Buffers.4.5.1/ref/net45/System.Buffers.xml",
"chars": 3479,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?><doc>\r\n <assembly>\r\n <name>System.Buffers</name>\r\n </assembly>\r\n <members>\r"
},
{
"path": "packages/System.Buffers.4.5.1/ref/netcoreapp2.0/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Buffers.4.5.1/ref/netstandard1.1/System.Buffers.xml",
"chars": 3479,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?><doc>\r\n <assembly>\r\n <name>System.Buffers</name>\r\n </assembly>\r\n <members>\r"
},
{
"path": "packages/System.Buffers.4.5.1/ref/netstandard2.0/System.Buffers.xml",
"chars": 3479,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?><doc>\r\n <assembly>\r\n <name>System.Buffers</name>\r\n </assembly>\r\n <members>\r"
},
{
"path": "packages/System.Buffers.4.5.1/ref/uap10.0.16299/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Buffers.4.5.1/useSharedDesignerContext.txt",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Buffers.4.5.1/version.txt",
"chars": 42,
"preview": "7601f4f6225089ffb291dc7d58293c7bbf5c5d4f\r\n"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ThirdPartyNotices.txt",
"chars": 1617,
"preview": "This Microsoft .NET Library may incorporate components from the projects listed\r\nbelow. Microsoft licenses these compone"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/dotnet_library_license.txt",
"chars": 9338,
"preview": "\r\nMICROSOFT SOFTWARE LICENSE TERMS\r\n\r\n\r\nMICROSOFT .NET LIBRARY \r\n\r\nThese license terms are an agreement between Microsof"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/lib/MonoAndroid10/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/lib/MonoTouch10/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/lib/xamarinios10/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/lib/xamarinmac20/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/lib/xamarintvos10/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/lib/xamarinwatchos10/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/MonoAndroid10/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/MonoTouch10/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/netstandard1.3/System.Diagnostics.Process.xml",
"chars": 99526,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Diagnostics.Process</name>\r\n </assembly>"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/netstandard1.3/de/System.Diagnostics.Process.xml",
"chars": 104557,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Diagnostics.Process</name>\r\n </assembly>"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/netstandard1.3/es/System.Diagnostics.Process.xml",
"chars": 103109,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Diagnostics.Process</name>\r\n </assembly>"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/netstandard1.3/fr/System.Diagnostics.Process.xml",
"chars": 102203,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Diagnostics.Process</name>\r\n </assembly>"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/netstandard1.3/it/System.Diagnostics.Process.xml",
"chars": 102348,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Diagnostics.Process</name>\r\n </assembly>"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/netstandard1.3/ja/System.Diagnostics.Process.xml",
"chars": 85386,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Diagnostics.Process</name>\r\n </assembly>"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/netstandard1.3/ko/System.Diagnostics.Process.xml",
"chars": 85422,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Diagnostics.Process</name>\r\n </assembly>"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/netstandard1.3/ru/System.Diagnostics.Process.xml",
"chars": 100538,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Diagnostics.Process</name>\r\n </assembly>"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/netstandard1.3/zh-hans/System.Diagnostics.Process.xml",
"chars": 79443,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Diagnostics.Process</name>\r\n </assembly>"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/netstandard1.3/zh-hant/System.Diagnostics.Process.xml",
"chars": 80330,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Diagnostics.Process</name>\r\n </assembly>"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/netstandard1.4/System.Diagnostics.Process.xml",
"chars": 99526,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Diagnostics.Process</name>\r\n </assembly>"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/netstandard1.4/de/System.Diagnostics.Process.xml",
"chars": 104557,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Diagnostics.Process</name>\r\n </assembly>"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/netstandard1.4/es/System.Diagnostics.Process.xml",
"chars": 103109,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Diagnostics.Process</name>\r\n </assembly>"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/netstandard1.4/fr/System.Diagnostics.Process.xml",
"chars": 102203,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Diagnostics.Process</name>\r\n </assembly>"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/netstandard1.4/it/System.Diagnostics.Process.xml",
"chars": 102348,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Diagnostics.Process</name>\r\n </assembly>"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/netstandard1.4/ja/System.Diagnostics.Process.xml",
"chars": 85386,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Diagnostics.Process</name>\r\n </assembly>"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/netstandard1.4/ko/System.Diagnostics.Process.xml",
"chars": 85422,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Diagnostics.Process</name>\r\n </assembly>"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/netstandard1.4/ru/System.Diagnostics.Process.xml",
"chars": 100538,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Diagnostics.Process</name>\r\n </assembly>"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/netstandard1.4/zh-hans/System.Diagnostics.Process.xml",
"chars": 79443,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Diagnostics.Process</name>\r\n </assembly>"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/netstandard1.4/zh-hant/System.Diagnostics.Process.xml",
"chars": 80330,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Diagnostics.Process</name>\r\n </assembly>"
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/xamarinios10/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/xamarinmac20/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/xamarintvos10/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/ref/xamarinwatchos10/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Diagnostics.Process.4.3.0/runtimes/win7/lib/netcore50/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Memory.4.5.5/LICENSE.TXT",
"chars": 1139,
"preview": "The MIT License (MIT)\r\n\r\nCopyright (c) .NET Foundation and Contributors\r\n\r\nAll rights reserved.\r\n\r\nPermission is hereby "
},
{
"path": "packages/System.Memory.4.5.5/THIRD-PARTY-NOTICES.TXT",
"chars": 15829,
"preview": ".NET Core uses third-party libraries or other resources that may be\r\ndistributed under licenses different than the .NET "
},
{
"path": "packages/System.Memory.4.5.5/lib/net461/System.Memory.xml",
"chars": 13948,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?><doc>\r\n <assembly>\r\n <name>System.Memory</name>\r\n </assembly>\r\n <members>\r\n"
},
{
"path": "packages/System.Memory.4.5.5/lib/netcoreapp2.1/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Memory.4.5.5/lib/netstandard1.1/System.Memory.xml",
"chars": 13948,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?><doc>\r\n <assembly>\r\n <name>System.Memory</name>\r\n </assembly>\r\n <members>\r\n"
},
{
"path": "packages/System.Memory.4.5.5/lib/netstandard2.0/System.Memory.xml",
"chars": 13948,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?><doc>\r\n <assembly>\r\n <name>System.Memory</name>\r\n </assembly>\r\n <members>\r\n"
},
{
"path": "packages/System.Memory.4.5.5/ref/netcoreapp2.1/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Memory.4.5.5/useSharedDesignerContext.txt",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Memory.4.5.5/version.txt",
"chars": 42,
"preview": "32b491939fbd125f304031c35038b1e14b4e3958\r\n"
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/LICENSE.TXT",
"chars": 1139,
"preview": "The MIT License (MIT)\r\n\r\nCopyright (c) .NET Foundation and Contributors\r\n\r\nAll rights reserved.\r\n\r\nPermission is hereby "
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/THIRD-PARTY-NOTICES.TXT",
"chars": 15829,
"preview": ".NET Core uses third-party libraries or other resources that may be\r\ndistributed under licenses different than the .NET "
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/lib/MonoAndroid10/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/lib/MonoTouch10/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/lib/net46/System.Numerics.Vectors.xml",
"chars": 183482,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?><doc>\r\n <assembly>\r\n <name>System.Numerics.Vectors</name>\r\n </assembly>\r\n <"
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/lib/netcoreapp2.0/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/lib/netstandard1.0/System.Numerics.Vectors.xml",
"chars": 183482,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?><doc>\r\n <assembly>\r\n <name>System.Numerics.Vectors</name>\r\n </assembly>\r\n <"
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/lib/netstandard2.0/System.Numerics.Vectors.xml",
"chars": 183482,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?><doc>\r\n <assembly>\r\n <name>System.Numerics.Vectors</name>\r\n </assembly>\r\n <"
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/lib/portable-net45+win8+wp8+wpa81/System.Numerics.Vectors.xml",
"chars": 183482,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?><doc>\r\n <assembly>\r\n <name>System.Numerics.Vectors</name>\r\n </assembly>\r\n <"
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/lib/uap10.0.16299/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/lib/xamarinios10/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/lib/xamarinmac20/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/lib/xamarintvos10/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/lib/xamarinwatchos10/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/ref/MonoAndroid10/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/ref/MonoTouch10/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/ref/net45/System.Numerics.Vectors.xml",
"chars": 183482,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?><doc>\r\n <assembly>\r\n <name>System.Numerics.Vectors</name>\r\n </assembly>\r\n <"
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/ref/net46/System.Numerics.Vectors.xml",
"chars": 183482,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?><doc>\r\n <assembly>\r\n <name>System.Numerics.Vectors</name>\r\n </assembly>\r\n <"
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/ref/netcoreapp2.0/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/ref/netstandard1.0/System.Numerics.Vectors.xml",
"chars": 183482,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?><doc>\r\n <assembly>\r\n <name>System.Numerics.Vectors</name>\r\n </assembly>\r\n <"
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/ref/netstandard2.0/System.Numerics.Vectors.xml",
"chars": 183482,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?><doc>\r\n <assembly>\r\n <name>System.Numerics.Vectors</name>\r\n </assembly>\r\n <"
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/ref/uap10.0.16299/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/ref/xamarinios10/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/ref/xamarinmac20/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/ref/xamarintvos10/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/ref/xamarinwatchos10/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/useSharedDesignerContext.txt",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Numerics.Vectors.4.5.0/version.txt",
"chars": 42,
"preview": "30ab651fcb4354552bd4891619a0bdd81e0ebdbf\r\n"
},
{
"path": "packages/System.Runtime.CompilerServices.Unsafe.6.0.0/LICENSE.TXT",
"chars": 1139,
"preview": "The MIT License (MIT)\r\n\r\nCopyright (c) .NET Foundation and Contributors\r\n\r\nAll rights reserved.\r\n\r\nPermission is hereby "
},
{
"path": "packages/System.Runtime.CompilerServices.Unsafe.6.0.0/THIRD-PARTY-NOTICES.TXT",
"chars": 46983,
"preview": ".NET Runtime uses third-party libraries or other resources that may be\r\ndistributed under licenses different than the .N"
},
{
"path": "packages/System.Runtime.CompilerServices.Unsafe.6.0.0/buildTransitive/netcoreapp2.0/System.Runtime.CompilerServices.Unsafe.targets",
"chars": 453,
"preview": "<Project InitialTargets=\"NETStandardCompatError_System_Runtime_CompilerServices_Unsafe_netcoreapp3_1\">\r\n <Target Name=\""
},
{
"path": "packages/System.Runtime.CompilerServices.Unsafe.6.0.0/buildTransitive/netcoreapp3.1/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Runtime.CompilerServices.Unsafe.6.0.0/lib/net461/System.Runtime.CompilerServices.Unsafe.xml",
"chars": 20527,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Runtime.CompilerServices.Unsafe</name>\r\n "
},
{
"path": "packages/System.Runtime.CompilerServices.Unsafe.6.0.0/lib/net6.0/System.Runtime.CompilerServices.Unsafe.xml",
"chars": 20527,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Runtime.CompilerServices.Unsafe</name>\r\n "
},
{
"path": "packages/System.Runtime.CompilerServices.Unsafe.6.0.0/lib/netcoreapp3.1/System.Runtime.CompilerServices.Unsafe.xml",
"chars": 20527,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Runtime.CompilerServices.Unsafe</name>\r\n "
},
{
"path": "packages/System.Runtime.CompilerServices.Unsafe.6.0.0/lib/netstandard2.0/System.Runtime.CompilerServices.Unsafe.xml",
"chars": 20527,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Runtime.CompilerServices.Unsafe</name>\r\n "
},
{
"path": "packages/System.Runtime.CompilerServices.Unsafe.6.0.0/useSharedDesignerContext.txt",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Security.Cryptography.Pkcs.6.0.1/LICENSE.TXT",
"chars": 1139,
"preview": "The MIT License (MIT)\r\n\r\nCopyright (c) .NET Foundation and Contributors\r\n\r\nAll rights reserved.\r\n\r\nPermission is hereby "
},
{
"path": "packages/System.Security.Cryptography.Pkcs.6.0.1/THIRD-PARTY-NOTICES.TXT",
"chars": 47721,
"preview": ".NET Runtime uses third-party libraries or other resources that may be\r\ndistributed under licenses different than the .N"
},
{
"path": "packages/System.Security.Cryptography.Pkcs.6.0.1/buildTransitive/netcoreapp2.0/System.Security.Cryptography.Pkcs.targets",
"chars": 438,
"preview": "<Project InitialTargets=\"NETStandardCompatError_System_Security_Cryptography_Pkcs_netcoreapp3_1\">\r\n <Target Name=\"NETSt"
},
{
"path": "packages/System.Security.Cryptography.Pkcs.6.0.1/buildTransitive/netcoreapp3.1/_._",
"chars": 0,
"preview": ""
},
{
"path": "packages/System.Security.Cryptography.Pkcs.6.0.1/lib/net461/System.Security.Cryptography.Pkcs.xml",
"chars": 11026,
"preview": "<?xml version=\"1.0\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Security.Cryptography.Pkcs</name>\r\n </assembly>\r\n "
},
{
"path": "packages/System.Security.Cryptography.Pkcs.6.0.1/lib/net6.0/System.Security.Cryptography.Pkcs.xml",
"chars": 39362,
"preview": "<?xml version=\"1.0\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Security.Cryptography.Pkcs</name>\r\n </assembly>\r\n "
},
{
"path": "packages/System.Security.Cryptography.Pkcs.6.0.1/lib/netcoreapp3.1/System.Security.Cryptography.Pkcs.xml",
"chars": 45583,
"preview": "<?xml version=\"1.0\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Security.Cryptography.Pkcs</name>\r\n </assembly>\r\n "
},
{
"path": "packages/System.Security.Cryptography.Pkcs.6.0.1/lib/netstandard2.0/System.Security.Cryptography.Pkcs.xml",
"chars": 36400,
"preview": "<?xml version=\"1.0\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Security.Cryptography.Pkcs</name>\r\n </assembly>\r\n "
},
{
"path": "packages/System.Security.Cryptography.Pkcs.6.0.1/lib/netstandard2.1/System.Security.Cryptography.Pkcs.xml",
"chars": 45583,
"preview": "<?xml version=\"1.0\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Security.Cryptography.Pkcs</name>\r\n </assembly>\r\n "
},
{
"path": "packages/System.Security.Cryptography.Pkcs.6.0.1/runtimes/win/lib/net461/System.Security.Cryptography.Pkcs.xml",
"chars": 11026,
"preview": "<?xml version=\"1.0\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Security.Cryptography.Pkcs</name>\r\n </assembly>\r\n "
},
{
"path": "packages/System.Security.Cryptography.Pkcs.6.0.1/runtimes/win/lib/net6.0/System.Security.Cryptography.Pkcs.xml",
"chars": 43039,
"preview": "<?xml version=\"1.0\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Security.Cryptography.Pkcs</name>\r\n </assembly>\r\n "
},
{
"path": "packages/System.Security.Cryptography.Pkcs.6.0.1/runtimes/win/lib/netcoreapp3.1/System.Security.Cryptography.Pkcs.xml",
"chars": 49260,
"preview": "<?xml version=\"1.0\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Security.Cryptography.Pkcs</name>\r\n </assembly>\r\n "
},
{
"path": "packages/System.Security.Cryptography.Pkcs.6.0.1/runtimes/win/lib/netstandard2.0/System.Security.Cryptography.Pkcs.xml",
"chars": 40077,
"preview": "<?xml version=\"1.0\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Security.Cryptography.Pkcs</name>\r\n </assembly>\r\n "
},
{
"path": "packages/System.Security.Cryptography.Pkcs.6.0.1/runtimes/win/lib/netstandard2.1/System.Security.Cryptography.Pkcs.xml",
"chars": 49260,
"preview": "<?xml version=\"1.0\"?>\r\n<doc>\r\n <assembly>\r\n <name>System.Security.Cryptography.Pkcs</name>\r\n </assembly>\r\n "
},
{
"path": "packages/System.Security.Cryptography.Pkcs.6.0.1/useSharedDesignerContext.txt",
"chars": 0,
"preview": ""
}
]
// ... and 24 more files (download for full content)
About this extraction
This page contains the full source code of the advanced-threat-research/DotDumper GitHub repository, extracted and formatted as plain text for AI agents and large language models (LLMs). The extraction includes 193 files (4.6 MB), approximately 1.2M tokens, and a symbol index with 553 extracted functions, classes, methods, constants, and types. Use this with OpenClaw, Claude, ChatGPT, Cursor, Windsurf, or any other AI tool that accepts text input. You can copy the full output to your clipboard or download it as a .txt file.
Extracted by GitExtract — free GitHub repo to text converter for AI. Built by Nikandr Surkov.