using System;

using System.Runtime.CompilerServices;

using System.Runtime.InteropServices;

​

namespace Makeref_Safe_OnStack

{

    public class Program

    {

        public static void Main(string[] args)

        {

            Structure structure = new Structure();

            structure.syncBlock = 0xBADF00D;

            structure.methodHandle = 0xBADF00D;

            structure.field = 0xBADF00D;

​

            var method = typeof(Program).GetMethod("GetStackAddress", System.Reflection.BindingFlags.Static | System.Reflection.BindingFlags.NonPublic);

            RuntimeHelpers.PrepareMethod(method.MethodHandle);

            var codeAddress = method.MethodHandle.GetFunctionPointer();

​

            Console.WriteLine(codeAddress.ToString("X"));

​

            Marshal.Copy(addressGetter, 0, codeAddress, addressGetter.Length);

​

            var structureAddress = GetStackAddress() + 132;

            Console.WriteLine(structureAddress.ToString("X"));

​

            structure.syncBlock = 0;

            structure.methodHandle = (int)typeof(Klass).TypeHandle.Value;

            structure.field = 123;

​

            Holder<Klass> holder = new Holder<Klass>();

            GCHandle holderHandle = GCHandle.Alloc(holder);

            var holderAddress = Marshal.ReadIntPtr(GCHandle.ToIntPtr(holderHandle));

            Marshal.WriteIntPtr(holderAddress, 4, structureAddress + 4); // Skip first integer for sync block, assumes x86

​

            Console.WriteLine(holder.reference.GetType());

            Console.WriteLine(holder.reference.Field);

​

            structure.field = 456;

            Console.WriteLine(holder.reference.Field);

        }

​

        static byte[] addressGetter = new byte[] 

        {

            0x89, 0xE0, // mov eax, esp

            0xC3        // ret

        };

​

        static IntPtr GetStackAddress()

        {

            Console.WriteLine("Some dummy code to be replaced");

            return IntPtr.Zero;

        }

    }

​

    class Holder<T>

    {

        public T reference;

    }

​

    class Klass

    {

        public int Field;

    }

​

    struct Structure

    {

        public int syncBlock;

        public int methodHandle;

        public int field;

    }

}

​