<p>Can you use windows hooks or other methods to do code injection with c#? I've seen lots of things about code injection but all of them are done in C/C++. I don't know either of those languages and have a really hard time translating. Does anyone have any ideas on how to do this?</p>

[{'answer_id': 24254, 'author': 'aku', 'author_id': 1196, 'author_profile': 'https://Stackoverflow.com/users/1196', 'pm_score': 4, 'selected': True, 'text': '<p>Kevin,\nit is possible. You can create library with window hook proc using managed C++. All you need to do is to inject this hook into some application using standard WinAPI (SetWindowsHookEx etc.). Inside this hook you can call System::AppDomain::CurrentDomain->Load method to load your assembly into target application\'s AppDomain. Then you can call methods defined in your assembly using reflection. For example, <a href="https://web.archive.org/web/20081228210203/http://blois.us/Snoop/" rel="nofollow noreferrer">Snoop</a> uses this method.</p>\n'}, {'answer_id': 260019, 'author': 'Sam Saffron', 'author_id': 17174, 'author_profile': 'https://Stackoverflow.com/users/17174', 'pm_score': 2, 'selected': False, 'text': '<p>Mike Stall has <a href="http://blogs.msdn.com/jmstall/archive/2006/09/28/managed-create-remote-thread.aspx" rel="nofollow noreferrer">this sample</a>, that uses CreateRemoteThread. It has the advantage of not requiring any C++. </p>\n'}, {'answer_id': 8488653, 'author': 'GeekzSG', 'author_id': 899578, 'author_profile': 'https://Stackoverflow.com/users/899578', 'pm_score': 2, 'selected': False, 'text': '<p>You can check out CInject for code injection into .NET assemblies at CodePlex site <a href="http://codeinject.codeplex.com/" rel="nofollow">http://codeinject.codeplex.com/</a>. You don\'t need to have any knowledge about code injection to inject any code when you are using CInject.</p>\n'}, {'answer_id': 39620743, 'author': 'unknown6656', 'author_id': 3902603, 'author_profile': 'https://Stackoverflow.com/users/3902603', 'pm_score': 2, 'selected': False, 'text': '<p><strong>EDIT:</strong> I seem to have misinterpreted the question .... I was under the impression that the question was about code injection into the current process.\n<hr/>\n<em>I am joining the party rather late, but I have just used exactly this a few weeks ago:</em></p>\n\n<p>A delegate contains the private fields <a href="http://referencesource.microsoft.com/#mscorlib/system/delegate.cs,0dd8585ba1833ad7" rel="nofollow"><code>IntPtr _methodPtr</code> and <code>IntPtr _methodPtrAux</code></a>, which represent the body\'s memory address. By setting the field (via reflection) to specific values, one can alter the memory address, to which the EIP will be pointing.\n<br/>\nUsing this information, one can do the following:</p>\n\n<ol>\n<li>Create an array with assembly bytes, which are to be executed</li>\n<li>Move the delegate\'s method pointer to the bytes in question</li>\n<li>Call the delegate</li>\n<li>Profit ???</li>\n</ol>\n\n<p><em>(Of course, you can change the <code>_methodPtr</code>-value to any memory address -- even in the kernel space, but this might require appropriate execution privileges).</em>\n<hr/>\nI have a working code example here, if you want:</p>\n\n<pre><code>public static unsafe int? InjectAndRunX86ASM(this Func&lt;int&gt; del, byte[] asm)\n{\n    if (del != null)\n        fixed (byte* ptr = &amp;asm[0])\n        {\n            FieldInfo _methodPtr = typeof(Delegate).GetField("_methodPtr", BindingFlags.NonPublic | BindingFlags.Instance);\n            FieldInfo _methodPtrAux = typeof(Delegate).GetField("_methodPtrAux", BindingFlags.NonPublic | BindingFlags.Instance);\n\n            _methodPtr.SetValue(del, ptr);\n            _methodPtrAux.SetValue(del, ptr);\n\n            return del();\n        }\n    else\n        return null;\n}\n</code></pre>\n\n<p>Which can be used as follows:</p>\n\n<pre><code>Func&lt;int&gt; del = () =&gt; 0;\nbyte[] asm_bytes = new byte[] { 0xb8, 0x15, 0x03, 0x00, 0x00, 0xbb, 0x42, 0x00, 0x00, 0x00, 0x03, 0xc3 };\n// mov eax, 315h\n// mov ebx, 42h\n// add eax, ebx\n// ret\n\nint res = del.InjectAndRunX86ASM(asm_bytes); // should be 789 + 66 = 855\n</code></pre>\n\n<p>Of course, on could also write the following method:</p>\n\n<pre><code>public static unsafe int RunX86ASM(byte[] asm)\n{\n    Func&lt;int&gt; del = () =&gt; 0; // create a delegate variable\n    Array.Resize(ref asm, asm.Length + 1);\n\n    // add a return instruction at the end to prevent any memory leaks\n    asm[asm.Length - 1] = 0xC3;\n\n    fixed (byte* ptr = &amp;asm[0])\n    {\n        FieldInfo _methodPtr = typeof(Delegate).GetField("_methodPtr", BindingFlags.NonPublic | BindingFlags.Instance);\n        FieldInfo _methodPtrAux = typeof(Delegate).GetField("_methodPtrAux", BindingFlags.NonPublic | BindingFlags.Instance);\n\n        _methodPtr.SetValue(del, ptr);\n        _methodPtrAux.SetValue(del, ptr);\n\n        return del();\n    }\n}\n</code></pre>\n\n<p>The same could probably be done to existing methods (not delegates) via reflection:</p>\n\n<pre><code>// UNTESTED //\n\nAction new_method_body = () =&gt; { };\nMethodInfo nfo = typeof(MyType).GetMethod( ..... );\nIntPtr ptr = nfo.MethodHandle.Value; // ptr is a pointer to the method in question\n\nInjectX86ASM(new_method_body, new byte[] { ......., 0xC3 }); // assembly bytes to be injected\n\nint target = new_method_body.Method.MethodHandle.Value.ToInt32();\n\nbyte[] redirector = new byte[] {\n    0xE8,   // CALL INSTRUCTION + TARGET ADDRESS IN LITTLE ENDIAN\n    (byte)(target &amp; 0xff),\n    (byte)((target &gt;&gt; 8) &amp; 0xff),\n    (byte)((target &gt;&gt; 16) &amp; 0xff),\n    (byte)((target &gt;&gt; 24) &amp; 0xff),\n    0xC3,   // RETURN INSTRUCTION\n};\nMarshal.Copy(redirector, 0, ptr, redirector.Length);\n</code></pre>\n\n<p><hr/>\n<strong>Use any code at your own risk.</strong> The code examples must be compiled with the <a href="https://msdn.microsoft.com/en-us/library/ct597kb0.aspx" rel="nofollow"><code>/unsafe</code>-compiler switch</a>.</p>\n'}]
['https://Stackoverflow.com/questions/24241', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/2128/']