Inject C# In Any .NET App With This Secret Entry Point

Hello everybody I'm Nick and in this video I will show you a .NET feature that very few people know, called startup hooks. Startup hooks allow you to inject .NET code into your application and have it run as part of your app's process without having to build it with the application every time.

Don't forget to comment, like and subscribe :)

Social Media:

#csharp #dotnet

[HenryETaylor]

Not sure that this one is for me. I always try to maximize obvious-ness in my code so that the next programmer (or the future me) will have an easy time understanding it. Launching a block of code through an environment variable value is very cool, but way too magical for what I value which is obvious-ness. Comments could help, but I've met many junior programmers who are too proud or lazy to read the comments. I will however start logging the value of that environment variable in my startup code, just in case some other member on my team doesn't share my aversion to magic. Thanks for another great video!

[alphaios]

It’s so cool to see stuff like this! I remember many moons ago I created a way of loading other assemblies with WebForms into my main WebForms project. We had some huge forms with many files that all had same structure so I created a project template for it and the main project would load it dynamically using virtual routes. It was kind of a reflection hell and I don’t remember how I even did it, but it felt so good when it worked!

[shahfaisal]

you know what?
I never understand your videos but watch like crazy.
I wish to be a developer like you.
Love and peace from Afghanistan.

[xcgasparxc]

I was waiting for something like this!! Don't shy out to make more content like this!

[DxCKnew]

This feature while cool, it seems to me like a malware paradise. A malware can use it to hide itself from Task Manager, operating from inside random non-malware processes. Also it can read everything including passwords and encryption keys from within the process.

[JoachimFosse]

4:20 I see absoloutly no malicious use cases for this feature 👍👍

[Alca]

Hi, i love your videos. I have two questions:
- If i want to prevent code injection by this way, can i clean environment variable at Program?
- What's happen if hook throw a exception? The entire application will shutdown?
Thank you!

[mountiedm]

So I've always poked around dotnet (around version 3) and really loved the syntax and especially love powershell.

But since I discovered your channel, I've moved from casual programmer, to whatever the next level is. Coinciding with my new obsession with microcontrollers, you've really just made what would have been an insane amount of hours of staring at code a much smoother process. Like, you make advanced stuff digestable.

Thank you!!

[codingbloke]

Did not know about this. Very surprising!

[kuriel]

i've done this before, you can also use c# compiler to generate assembly directly to memory and execute it from there, therefore you could run c# code (not dll) directly from your application

[crdowney]

Never seen this before, thank you for showing this to us.

[VerifiedNobody]

.net framework was comparatively safe when it comes to vulnerabilities and RCE. This one feature will turn that around for sure. its only time before this feature becomes the Achilles heel for dotnet core.

[mihaiga]

Great content, as always! Could you do a video about plug-ins? I am interested if it's possible to deploy custom logic to client apps as optional libraries.

[chesthar]

I'm happy to know how hooks works. And also hapy that probably I'll never use it. The fact that you can't use nuget packages installed dirctly into the hook library is a serious disadvantage. For me hooks are relatated to the platform infrastucture. And from architectural point of view if I'm not required to use it I'll just not use it or at least not with hooks.

[andreibicu]

Great content, as usual!
And regarding the workshops, I am very happy to see you're coming to Iași, a beautiful city in Romania. Actually it is the former capital of Romania and the 2nd largest in the country, with a big community in IT industry.
This is why I believe it deserves to be mentioned in your announcements, next to "dotnetdays", the same as all the other more known cities.

[klam]

Hi Nick thanks for this great video. A question: is the text writer example at the end thread safe? I see that text writer has a wrapper called Synchronized that is thread safe. And not sure of the performance. thanks.

[cemalgulbeyaz]

I ussualy set 1, 5x speed codding videos on youtube but i dont need while i watching yours :)

[Fnalspace]

Very cool, this will definitily come in handy. I knew about the assembly resolver, but not so much about the hooking.
Also i didn´t knew that you could redirect the console logging like that - i like that. Thanks for sharing.

[kinsondigital]

I have been writing dotnet code for a really really long time and had no idea about this. This is pretty awesome!!
Is there any official dotnet docs on this feature?

[Luke-meqe]

Heck I am going to fetch my metrics and push it to elastic. Even from my legacy projects. Incredible!