2x1=10

I recent­ly remem­bered a fel­low stu­dent who, a cou­ple of years ago, told me that he inject­ed a (native) DLL into a for­eign process and start­ed the .NET run­time there, that is, had C# code run in a for­eign native process. Well, bright eyes on my side and then I for­got about it.

Any­way, some days ago I gave it a try and it found out that this isn’t too hard to achieve. Run­ning your .NET assem­bly in a native appli­ca­tion requires basi­cal­ly four steps using the .NET 4 Host­ing Inter­faces:

1. Retriev­ing an inter­face to the CLR (meta) host.
2. Request­ing an inter­face to the required run­time.
3. Retriev­ing the actu­al inter­face of the run­time.
4. Exe­cut­ing the assem­bly in the default appli­ca­tion domain.

So here we go, ignor­ing all return codes on the way:

Step 1: Retrieve the CLR Meta Host interface

First of all, we ref­er­ence mscoree.dll and include the required head­ers.

#pragma comment(lib, "mscoree.lib") // [sic]

#include <mscoree.h>
#include <metahost.h>

We now cre­ate an instance of the CLR meta host inter­face. This is basi­cal­ly the moth­er of all hosts, and we’ll use it to fetch infor­ma­tion about a spe­cif­ic run­time lat­er.

ICLRMetaHost *pMetaHost = NULL;
CLRCreateInstance(CLSID_CLRMetaHost, IID_PPV_ARGS(&pMetaHost));

Step 2: Request an interface to the runtime

Using the meta host, we’ll request an inter­face describ­ing the ver­sion and sta­tus of the run­time we’d like to start.

ICLRRuntimeInfo *pRuntimeInfo = NULL;
pMetaHost->GetRuntime(L"v4.0.30319", IID_PPV_ARGS(&pRuntimeInfo));

In this case, we request the .NET run­time v4.0.30319. Note that, accord­ing to the doc­u­men­ta­tion, the v is manda­to­ry and the giv­en fold­er has to exist in your %SystemRoot%\Microsoft.NET\Framework direc­to­ry.

Step 3: Retrieve and start the runtime

From the giv­en ICLRRuntimeInfo we can now retrieve the ICLRRuntimeHost inter­face, which is the .NET 4 equiv­a­lent to the now dep­re­cat­ed .NET 1 ICorRuntimeHost, an inter­face that enables us to start and stop the CLR, cre­ate and con­trol domains.

ICLRRuntimeHost *pClrRuntimeHost = NULL;
pRuntimeInfo->GetInterface(CLSID_CLRRuntimeHost, 
                           IID_PPV_ARGS(&pClrRuntimeHost));

// fire up the runtime. note that this step may 
// take ages when running with an attached debugger.
pClrRuntimeHost->Start();

Step 4: Execute your assembly in the default application domain

Assum­ing your assem­bly con­tains a class YourClass in the Your.Namespace name­space and that this class con­tains a method static int YourMethod(string parameter), this is how you invoke it:

static const LPCWSTR assemblyPath = L"C:\\path\\to\\your\\assembly.dll";
static const LPCWSTR classFqn = L"Your.Namespace.YourClass";
static const LPCWSTR methodName = L"YourMethod";
static const LPCWSTR parameter = L"your argument";

DWORD dwRet = 0;
pClrRuntimeHost->ExecuteInDefaultAppDomain(
	assemblyPath, classFqn, methodName, parameter, &dwRet);

And that’s it. What’s left is par­ty­ing hard and a bit of cleanup if you’re a nice guy. Or gal. Or per­son.

Step 5 and 6: ??? and Profit

Rumor has it that shut­ting down and releas­ing the run­time itself isn’t nec­es­sar­i­ly need­ed; You should release the meta host though.

// you might skip these steps in order to keep the runtime running
pClrRuntimeHost->Stop();
pClrRuntimeHost->Release();

// release the meta host
pMetaHost->Release();

Either way, now’s a good time for a cup of cof­fee. And that par­ty.

As for the whole injec­tion thing, I have some patchy hacky code on GitHub.