JITHOOK

The goal of this repository is to show you techniques for packing/unpacking .NET assemblies (programs) by abusing .NET's JIT mechanism.

Build

Clone this project

git clone --recursive https://github.com/LJP-TW/JITHook.git

Install lief-project/LIEF.
- Download LIEF-0.12.1-win64.zip
- Decompress it to JITHook/Lib. The following is the expected directory structure:
```
JITHook/
|- JITDemo
|- JITPacker
|- JITUnpacker
|- ...
|- Lib
   |- dnlib
   |- LIEF-0.12.1-win64
      |- include
      |- lib
```
  - (You can remove folders bin and share in the LIEF folder)
  - (See LIEF Documentation for troubleshooting)
Open JIT_Hook.sln with Visual Studio Community 2022, configure project with release x64, press ctrl+shift+b to build the whole solution.
Check JITHook/Release to see result

JITDemo.exe

It's just a demo of patching method IL.

You can try to reverse-engineer it :)

JITPacker.exe [OPTION] <program path>

JITPacker.exe will pack the program.

OPTION:

Default program path is testprog.exe.

JITUnpacker.exe [OPTION] <packed program path>

WARNING: Please run JITUnpacker.exe in an isolated environment as it will execute the packed program.

JITUnpacker.exe will try to unpack the packed program.

OPTION:

-v <LEVEL>: Set verbose level, LEVEL can be 0 ~ 3. Default value is 2. Set LEVEL to a higher value to see more information.
-o <PATH>: Set output file path. Default path is output.exe_.

Default packed program path is JIThook.exe.

A test program with different functions: