.NET Reversing

[ShadowLocke]

Im using .NET reflector to extract a call I need to use in an unmanaged environment. I came accross function declared as "internal static extern" with the attribute "[MethodImpl(Meth odImplOptions.I nternalCall)]" How do I find the actual implementation of that call?

[anijos]

1. Download the Shared Source Common Language Infrastructure at the following link:

Download details: Shared Source Common Language Infrastructure 2.0 Release

2. Search ecall.cpp in the sscli20\clr\src \vm directory of the tgz file you just downloaded for "InternalGetHas hCode". You'll find something like this:

FCFuncElement("InternalGetHashCode", ObjectNative::GetHashCode)

This means that "InternalGetHas hCode" calls the GetHashCode method of the ObjectNative object. Now you have to find that method in the files you just downloaded.

3. Start looking through some of the other files. There are alot. I found this method under the file "comobject.cpp" :

// Note that we obtain a sync block index without actually building a sync block.   
// That's because a lot of objects are hashed, without requiring support for   
FCIMPL1(INT32, ObjectNative::GetHashCode, Object* obj) {   
       
    CONTRACTL   
    {   
        THROWS;   
        DISABLED(GC_NOTRIGGER);   
        INJECT_FAULT(FCThrow(kOutOfMemoryException););   
        MODE_COOPERATIVE;   
        SO_TOLERANT;   
    }   
    CONTRACTL_END;   
  
    VALIDATEOBJECTREF(obj);   
       
    DWORD idx = 0;   
       
    if (obj == 0)   
        return 0;   
       
    OBJECTREF objRef(obj);   
  
    HELPER_METHOD_FRAME_BEGIN_RET_1(objRef);        // Set up a frame   
  
           
    idx = GetHashCodeEx(OBJECTREFToObject(objRef));   
  
       
    HELPER_METHOD_FRAME_END();   
  
    return idx;   
}   
FCIMPLEND

There's your implementation!


A better explantion on how and why this works can be found here (Last Question of the article)

[ShadowLocke]

Thanks anijos. But looking through this i didnt find the particular function i was looking for "InternalReleas eComObject". After looking through the files you mentioned I did a search for ReleaseCom in every file with no luck. Any ideas?