2

I've been working on making a C# DLL which to be injected into a specific target application which is also written in C#. The goal is to manipulate the output of several functions of the .NET framework. I was successful in changing the value of reading a registry key by hooking the underlying windows API function, but I have trouble with the way it reads the system's harddisk signature and serial.

It uses the System.Management for it roughly this way:

using System.Management;

internal static string GetHarddiskIdentifier()
{
    string[] properties = new string[] {"Signature", "SerialNumber"};
    var class = new ManagementClass("Win32_DiskDrive");
    var instances = class.GetInstances();
    foreach (ManagementObject mo in instances) {
        foreach (string w in properties) {
            object o = mo[w];
            if (o != null)
                return o.ToString();
        }
    }
    return string.Empty;
}

I have went through the .NET reference source for the ManagementObject class, looking for winapi calls that I could hook, but I have not found anything useful. I also used an api monitor on a test program with just this code, but even with filtering it is like looking for a needle in a haystack.

My question is, how would I change the outcome of this method? I cannot hook the target application's method because the assembly is obfuscated so the name changes with every update.

StayOnTarget
  • 11,743
  • 10
  • 52
  • 81
HoLLy
  • 31
  • 1
  • 7

0 Answers0