Taming CoreClr Part-2

Hope you did not get bore with first blog of this series :)

I will be more technical going forward with code samples.
After successfully getting the Guid for CoreClr it was time to host CoreClr in custom host.
here is the code for it..

HMODULE clrmodule = LoadLibrary (TEXT ( "..//Coreclr.dll"));
GetCLRRuntimeHost _clrMethod;
_clrMethod = (GetCLRRuntimeHost)GetProcAddress( clrmodule , "GetCLRRuntimeHost" );

You will be eager to know the signature of GetCLRRuntimeHost.

typedef int (__stdcall *GetCLRRuntimeHost)(const IID &CLRGUID,PVOID* clrHost);

We got the method handler(method pointer).
Let us get the SilverlightCLR now:

ISilverlightCLRRuntimeHost *pCLR = NULL;
HRESULT a = _clrMethod(CLRGUID,(PVOID*) &pCLR);

One of the main question is still unanswered definition of ISilverlightCLRRuntimeHost?

As told earlier initial thought was it should be similar to (or same) ICLRRuntimeHost.
I used same interface and tried to call ExecuteApplication.
boom!!!! it crashed.
tried calling Start() again failed...with -2146234334 error code, HOST_E_INVALIDOPERATION.
Tried other methods from ICLRRuntimeHost but none worked.
So again i decided to debug Silverlight with IDA.
After taking the CLRHOST interface pointer they are making a call to
call eax //ECX+38h

where ECX is pointing to the vptr of coreclr object.
Now if i calculate 38h it becomes 12th method of interface,
here was a catch.. ICLRRuntimeHost only has 9 methods.
So it clears that SilverlightCLRRuntime host interface is having additional methods.
This method takes two parameters of int type

pCLR->Magic(2483181568,29805167);

I called this method Magic because the reason was not known for this call.
After making this call again i tried pCLR->Start()

bingo CLR was up :)

to be concluded.......