get patched segment from Method definition

[dashne]

Hi everyone, Is it possible to get segment as patched Segment from method definition or module definition? If not, is it possible to get PEFile from module definition or assembly definition without creating any new PEFile through ManagedPEFileBuilder, to get Segment from it, I mean I want applying patching bytes to original module (created from File path directly) that it is not created from a PEFile

thanks.

[Washi1337]

Typically, a ModuleDefinition should be seen as something on top of an PEImage or PEFile, not the other way around. Ideally, you should keep both instances alive upon reading the binary if you intend to use both the module and underlying file:

e.g.,

var file = PEFile.FromFile(...);
var module = ModuleDefinition.FromFile(file);

// At this point you can still use `file` here...

However, if you really must get the underlying PE file from a ModuleDefinition instance, you can only do this for SerializedModuleDefinitions, which have a ReaderContext containing the original PE image and thus also PE file:

ModuleDefinition module = ...;
if (module is SerializedModuleDefinition { ReaderContext.Image.PEFile: {} file })
{
   // `file` is the underlying PE file.
}

Keep in mind though that any Serialized class should be seen as a form of more internal API that may have a different set of guarantees that the normal public API provides. Additionally, keep in mind that changing a PEFile while also keeping alive a ModuleDefinition is considered unsafe and may have unwanted/unpredictable side-effects on the ModuleDefinition side (everything is lazy loaded on demand from the PEFile and is cached).

[dashne]

If I patch a method (hot patch) without saving peFile , does module will be updated automatically, for example if I pull cilMethodbody from that method after patching, does changed bytes will be applied to instructions?

[Washi1337]

A PEFile is not kept in sync with a ModuleDefinition created from it and vice versa. Because of the lazy initialization you may be lucky that it pulls the latest data, but this is not guaranteed. This is why changing an underlying PEFile instance is considered unsafe.