Ruptura Progress Report - January 2024

[alexrp]

This is part of a series of progress reports that are posted with a monthly-ish cadence when there's notable progress made on the project.

v2.0.179 Release

v2.0.179 was primarily a housekeeping release:

• We now require .NET 8 (net8.0).
  • We will support .NET LTS releases going forward. This, for example, means that .NET 8 will be supported until November 10, 2026.
• We applied [DisableRuntimeMarshalling] to all libraries.
• We made Vezel.Ruptura.Injection trimming-compatible.
• We added an MSBuild property called RupturaIncludeModules to opt out of including the injectable native module as a Content item.
• We refactored the API surface of the AssemblyInjectorOptions type to make it easier to construct and update.
• We changed AssemblyInjectorOptions.ModuleDirectory to use AppContext.BaseDirectory by default, ensuring correct behavior for all deployment modes.
• We implemented IEqualityOperators<TSelf, TOther, TResult> on some types that already implemented IEquatable<T>.

There were no major feature highlights in this release; the major version bump was primarily due to the update to .NET 8.

Future Plans

The major planned features for v3.0 are:

• Implement more space-efficient code managers #28
• Add a VirtualFunctionTableHook class in Vezel.Ruptura.Memory #31
• Support chasing unconditional jumps in FunctionHook #33
• FunctionHook should support using an absolute jump patch if the user requests it #34
• Add a CodeHook class for mid-function hooking #52

The major planned features for v4.0 are:

• Support injecting NativeAOT-compiled DLLs (.NET 8) #13
• Expand Vezel.Ruptura.System API surface and Win32 API coverage #15
• Evade Microsoft Defender detection when injecting #18
• Figure out a way to get source location in ManagedCallFrameSymbolicator #24
• CallTrace: Disassemble managed prestubs to find the real method address #26
• Support for relocation of RIP-relative instructions in FunctionHook #35

All other features are attached to the Future milestone, which basically just means they haven't been included in the working set for a particular version yet.