> Markdown version of [/videos/117-hacking-c-from-the-inside-how-to-do-anything-in-net?t=718](https://www.wearedevelopers.com/videos/117-hacking-c-from-the-inside-how-to-do-anything-in-net?t=718). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Hacking C# from the inside - how to do anything in NET

Bypass C# memory safety to execute raw machine code directly within your app. Neutralize fatal stack overflow exceptions and reshape the .NET framework from the inside.

- **Speakers:** Adam Furmanek
- **Event:** WeAreDevelopers LIVE
- **Published:** March 3, 2021
- **Duration:** 41:54
- **URL:** https://www.wearedevelopers.com/videos/117-hacking-c-from-the-inside-how-to-do-anything-in-net

## Summary

Developers frequently face runtime constraints in C# and .NET, such as enforced dynamic dispatch or application-crashing exceptions, which seemingly require altering the framework itself to overcome. By venturing below the high-level language constructs into intermediate language (IL), metadata manipulation, and CPU-level execution, it is possible to bypass these platform limitations entirely. Manipulating .NET from the inside reveals that constructs like delegates, tasks, and JIT-compiled methods are fundamentally just memory structures and byte arrays that can be intercepted and reshaped at runtime.

On the higher level, manipulating IL instructions via dynamic method generation allows developers to statically control method invocation, purposefully swapping dynamically bound `callvirt` instructions with static `call` instructions to avoid polymorphism. Similarly, developers can regain control over "fire-and-forget" `async void` methods simply by injecting a custom `TaskScheduler` and `SynchronizationContext`. This custom context tracks underlying thread operations as they start and complete, safely surfacing out-of-band exceptions that would otherwise terminate the application.

Moving deeper, bypassing memory safety enables raw machine code execution directly from byte arrays within C#. By locking memory addresses to prevent garbage collection and invoking OS-native memory protection APIs like `VirtualProtect` or `mprotect`, arbitrary x86 machine instructions can be bound to .NET delegates using `Marshal.GetDelegateForFunctionPointer`. This technique opens the door to method hijacking, where pre-JIT-compiled method descriptors are modified in-place to inject absolute machine-code jumps. As a result, calls to standard framework libraries can be silently redirected to custom implementations on the fly.

These low-level manipulations translate into powerful diagnostic and extension capabilities. Developers can hijack closed-framework constructors, such as those initializing `STARTUPINFO`, to expose hidden Windows API variables and launch instances on separate virtual desktops without forking the native runtime. At a systemic level, even a fatal `StackOverflowException` can be neutralized. By engaging OS-level vectored exception handlers (VEH) and aggressively saving and restoring CPU register states before and after volatile functions, applications and test runners can gracefully recover from stack exhaustion rather than crashing immediately.

**Keywords:** c# platform internals, .NET intermediate language manipulation, dynamic dispatch bypass, awaiting async void methods, custom synchronizationcontext implementation, raw machine code execution, memory page protection unlocking, method descriptor manipulation, runtime method hijacking, winapi interoperability, vectored exception handling, stackoverflowexception recovery, cpu register state restoration, x86 assembly integration, unhandled thread exception catching

## Chapters

1. **Overriding dynamic dispatch statically in object-oriented programming** (02:06) — Using intermediate language instructions to statically invoke methods and bypass polymorphic dynamic dispatch.
1. **Awaiting async void methods with custom task schedulers** (07:45) — Implementing custom synchronization contexts and task schedulers to aggregate and safely handle unwieldy async void methods.
1. **Executing raw native machine code directly from byte arrays** (11:58) — Bypassing standard compilers to allocate, unprotect memory, and execute dynamically generated assembly functions via delegate marshalling.
1. **Hijacking method execution paths with machine code replacement** (26:22) — Overriding runtime metadata and using generated intermediate offset jumps to dynamically redirect native execution behavior.
1. **Manipulating private platform constructs for target application placement** (30:26) — Overriding standard platform constructors to securely expose private underlying logic and assign initialized processes onto arbitrary virtual desktops.
1. **Preventing application crashes from unhandled thread exceptions** (36:09) — Intercepting core background object instantiation to automatically inject safety try-catch wrappers around unstable logic threads.
1. **Recovering recursive stack overflows with vectored exception handlers** (38:05) — Preventing hard crashes by registering lower level hardware exception interrupts to actively save and cleanly restore cpu execution context registers.

## Related Moments

- [Demonstrating code hot swapping in a running application](https://www.wearedevelopers.com/videos/100321-swapping-code-losing-memory-a-jvm-deep-dive) (from "Swapping Code, Losing Memory: A JVM Deep Dive")
- [Modifying execution flow using native debugger functions](https://www.wearedevelopers.com/videos/846-debugging-unveiled-exploring-debugger-internals-and-hidden-gems) (from "Debugging Unveiled: Exploring Debugger Internals and Hidden Gems")
- [Introduction to live debugging and code hot swapping](https://www.wearedevelopers.com/videos/100321-swapping-code-losing-memory-a-jvm-deep-dive) (from "Swapping Code, Losing Memory: A JVM Deep Dive")
- [Injecting runtime flexibility with aspect and microkernel architectures](https://www.wearedevelopers.com/videos/935-architectures-that-we-can-use-with-net) (from "Architectures that we can use with .NET")
- [Discovering application crashes caused by excessive code hot swapping](https://www.wearedevelopers.com/videos/100321-swapping-code-losing-memory-a-jvm-deep-dive) (from "Swapping Code, Losing Memory: A JVM Deep Dive")
- [Bypassing system constraints by extracting hidden instructions and rules](https://www.wearedevelopers.com/videos/986-manipulating-the-machine-prompt-injections-and-counter-measures) (from "Manipulating The Machine: Prompt Injections And Counter Measures")

## Related Articles

- [Dev Digest 127 - putting 5 rings on it](https://www.wearedevelopers.com/magazine/464-dev-digest-127-putting-5-rings-on-it)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)
- [Dev Digest 130 - The Diablo is in the details](https://www.wearedevelopers.com/magazine/470-dev-digest-130-the-diablo-is-in-the-details)

## Related Jobs

- [Engineer, Offensive Security Organization](https://www.wearedevelopers.com/jobs/ext/1992296-engineer-offensive-security-organization) at **Twilio**
- [Senior Software Engineer, Fraud](https://www.wearedevelopers.com/jobs/ext/1280398-senior-software-engineer-fraud) at **Twilio**
- [Principal Software Engineer, Enterprise AI Platform](https://www.wearedevelopers.com/jobs/ext/1467292-principal-software-engineer-enterprise-ai-platform) at **GitHub**
- [Senior Software Engineer](https://www.wearedevelopers.com/jobs/ext/15942-senior-software-engineer) at **GitHub**
- [Senior Software Engineer, Enterprise Products](https://www.wearedevelopers.com/jobs/ext/1841248-senior-software-engineer-enterprise-products) at **GitHub**
- [Senior Software Engineer,Billing](https://www.wearedevelopers.com/jobs/ext/1991843-senior-software-engineer-billing) at **GitHub**