The process of managed code injects the &CLR host

In the previous several blogs about CLR boarding (CLR boarding (upper) Mscoree. DLL,CLR hosted (medium) hosted EXE files are loaded and executed, and hosted by the CLR hosted (under) hosting, the common host interfaces are described. Host interface, which allows us to create a CLR host using unmanaged code to start the CLR, run managed code, and control garbage collection ... and a series of functions. This blog post is about a scenario that uses a CLR host--process injection.

Process injection is a technique that injects code into an existing process address space and executes it. There are many techniques for process injection, which is based on loaddll&createremotethread technology.

Generally, we compile the code to be executed into a DLL file and then load it into the target process. It is OK to load and execute an unmanaged DLL directly, but it would be a struggle to load a managed DLL into a process, because managed code cannot be executed directly, passing through the CLR two of times. How to solve this problem?

Because of the impact of the environment on the process injection, I will first list my experimental environment, and then specific explanation.

System: Windows 7, 64-bit

. net:4.0

Development tools: VS2010 SP1

Test program: All 32-bit programs

1.1 Implementing unmanaged code calls managed code

Here, a picture of a foreigner describes how our managed code is executed within the target process.

First, an unmanaged c++dll is injected into the target process using a program with an injection function, and the unmanaged DLL starts the CLR, loads the managed DLL to execute, and finally invokes the CLR to execute managed code.

The process looks simple, and the first problem to solve here is to create a c++dll as a CLR host.

Open VS2010 and select C + + Win32project project.

After you determine the next step, apply the type selection DLL and select the empty item in the additional options.

The project name I created is: Managecodeinvoker, as shown below: