[Generic info] Arbitrary code injection at startup

Started by RawCode, July 19, 2014, 11:21:56 PM

Previous topic - Next topic

RawCode

After some time i managed to learn c# basics found way to inject arbitrary code to game.
Few days before i posted question about this ( http://ludeon.com/forums/index.php?topic=4744.msg45856#msg45856 ) since no answer followed, looks like i first who managed to do this.

Game works in very predefined way:

Modloader will enumerate all loaded classes (types) that extends Def type and then search for valid xml definitions for such types.
There is no tricks with your own defs, as long as you extend "Def" type.

Classes loaded in predefined manner - loader will search subfolders inside Defs folder matching "<defname>+s" name.
Inside such folders all xml classes will be loaded loaded.

Xml's parsed in same manner as Folders and if XML define custom class for definition, such class will be initialized.
If your class "custom" by itself - there is no need to define it as custom, it will initialize anyway.
Everything you need - to have at least single xml definition of it.

Placing arbitrary payload to <cinit> section of such class allows to execute arbitrary code at early stages of game loading (before game started actually).

With ASM\Reflect you can alter internal states of classes and objects ever before game is actually started.
Due to modloading rules, there is no way to force enable itself or define custom ModMetaDef.

This is DLL part of injection.
You allowed to place anything inside cinit section.

namespace rc
{
    class Arbitrary : Def
    {
        static Arbitrary()
        {
            Prefs.DevMode = false;
            Log.Error("<CINIT> Section invocation (Type Constructor)");
            Log.Error(Environment.StackTrace);
        }
    }
}


Inside Defs folder your root def should have name "Arbitrarys".
XML file can have any name.
Inside XML should be something like this:

<?xml version="1.0" encoding="utf-8" ?>
<Arbitrarys>
<Arbitrary>
</Arbitrary>
</Arbitrarys>



Mod that will disable devmod attached to post.

[attachment deleted by admin: too old]

mrofa

Wow thats preety cool thanks for sharing this!

There was similar topic some long time ago i think it was made by pawnstrom with similar thing, but insted of injection i think he did somehow hooked up his code to sound that is played after mods are loaded, poor memory sorry :D
All i do is clutter all around.

RawCode

I researched most mods posted on this forum, they all hook on world generators.
Its probably "OK" but hooking directly is much better option.
And this option allow to hook and invoke code before game is started.