How to get memory base address of a c# assembly loaded in a different AppDomain

Question

You can get the memory base address of the modules loaded on your process with some code like this one below:

ProcessModuleCollection pc = Process.GetCurrentProcess().Modules;
foreach(ProcessModule pm in pc)
{
        Console.WriteLine("The moduleName is " + pm.ModuleName);
        Console.WriteLine("The " + pm.ModuleName + "'s base address is: " + pm.BaseAddress);
}

Unfortunately, this is not working with the scenario that I have. What I'm doing is to create a new and separated AppDomain (called Temporal) and using it to load an assembly from disk. Then, I just execute some function contained in the loaded assembly. This would be the code of the class that contains all this logic:

    public class Loader : MarshalByRefObject
    {
        object CallInternal(string dll, string method, string[] parameters)
        {
            byte[] buffer = File.ReadAllBytes(dll);
            Assembly a = Assembly.Load(buffer);
            Type[] types = a.GetTypes();
            MethodInfo m = null;
            Type myType = null;
            foreach (var type in types)
            {

                m = type.GetMethod(method);
                if (m != null)
                {
                    myType = type;
                    break;
                }
            }

            if (m != null && myType != null)
            {
                var myInstance = Activator.CreateInstance(myType);
                return m.Invoke(myInstance, new object[] { parameters });
            }
            else
            {
                return null;
            }
        }
        public static object Call(string dll, string method, params string[] parameters)
        {
            AppDomain dom = AppDomain.CreateDomain("Temporal");
            Loader ld = (Loader)dom.CreateInstanceAndUnwrap(Assembly.GetExecutingAssembly().FullName, typeof(Loader).FullName);
            object result = ld.CallInternal(dll, typename, method, parameters);
            return result;
        }

The question is, is there any way to get the memory base address of the loaded assembly without executing some sort of memory scan? The ProcessModuleCollection that you get from Process.GetCurrentProcess().Modules is not showing the assembly loaded in the AppDomain Temporal. Unsafe and unmanaged code allowed.

Answer 1

I found a way that uses Module.m_pData.

Here's the way:

1. Get m_pData from reflection via RuntimeModule:

   internal static class ModuleHelper
   {
       private static IDictionary<IntPtr, Module>? _mapAddressToModule;
       private static readonly FieldInfo m_pData;
       private static readonly MethodInfo GetHInstance;
   
       private static readonly object LoadLock = new();
       private static readonly object LockSelfMapsLinux = new object();
   
       static ModuleHelper()
       {
           m_pData = Type.GetType("System.Reflection.RuntimeModule")
               .GetField("m_pData", BindingFlags.NonPublic | BindingFlags.Instance);
           GetHInstance = typeof(Marshal).GetMethod("GetHINSTANCE", new[] { typeof(Module) })!;
           LoadMapScopeToHandle();
       }
   
       public static IntPtr GetAddressFromModule(Module module)
       {
           return (IntPtr)m_pData.GetValue(module);
       }
   }
   

2. In the below code, the method GetAddressFromModule() will return Module.m_pData:

   public static IntPtr GetAddressFromModule(Module module)
   {
       return (IntPtr)m_pData.GetValue(module);
   }
   

3. Use this like:

   Module module = assembly.ManifestModule;
   IntPtr m_pDataValue = ModuleHelper.GetAddressFromModule(module);
   

If the module is mscorlib.dll, for instance, then m_pData is 0x70f2100.

Answer 2

Try P/Invoke way to achieve this.

using System;
using System.Diagnostics;
using System.Reflection;
using System.Runtime.InteropServices;

public class Loader : MarshalByRefObject
{
    // Define MEMORY_BASIC_INFORMATION structure for VirtualQuery
    [StructLayout(LayoutKind.Sequential)]
    public struct MEMORY_BASIC_INFORMATION
    {
        public IntPtr BaseAddress;
        public IntPtr AllocationBase;
        public uint AllocationProtect;
        public IntPtr RegionSize;
        public uint State;
        public uint Protect;
        public uint Type;
    }

    // Import VirtualQuery API from kernel32.dll
    [DllImport("kernel32.dll")]
    public static extern int VirtualQuery(
        IntPtr lpAddress,
        out MEMORY_BASIC_INFORMATION lpBuffer,
        uint dwLength
    );

    object CallInternal(string dll, string method, string[] parameters)
    {
        byte[] buffer = File.ReadAllBytes(dll);
        Assembly a = Assembly.Load(buffer);
        Type[] types = a.GetTypes();
        MethodInfo m = null;
        Type myType = null;
        foreach (var type in types)
        {
            m = type.GetMethod(method);
            if (m != null)
            {
                myType = type;
                break;
            }
        }

        if (m != null && myType != null)
        {
            var myInstance = Activator.CreateInstance(myType);
            // Call the method
            var result = m.Invoke(myInstance, new object[] { parameters });

            // Find the base address of the loaded assembly
            FindBaseAddress(a);

            return result;
        }
        else
        {
            return null;
        }
    }

    public static object Call(string dll, string method, params string[] parameters)
    {
        AppDomain dom = AppDomain.CreateDomain("Temporal");
        Loader ld = (Loader)dom.CreateInstanceAndUnwrap(Assembly.GetExecutingAssembly().FullName, typeof(Loader).FullName);
        object result = ld.CallInternal(dll, method, parameters);
        return result;
    }

    // Method to find the base address of the loaded assembly
    private void FindBaseAddress(Assembly a)
    {
        // Get the address of the assembly entry point
        IntPtr assemblyHandle = Marshal.GetHINSTANCE(a.ManifestModule);

        // Use VirtualQuery to query memory regions
        MEMORY_BASIC_INFORMATION memInfo;
        VirtualQuery(assemblyHandle, out memInfo, (uint)Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION)));

        Console.WriteLine("Assembly Base Address: " + memInfo.BaseAddress);
    }
}