System.MissingMethodException – Bad profiler changing the method name

Usually System.MissingMethodException exception is thrown when there is an attempt to dynamically access a method that does not exist. Recently we worked on few issues where we saw applications throwing System.MissingMethodException intermittently. In these issues, the method names of the functions were changed by a special prefix “__AW_ ”.

For example, we saw the Exception type as ‘System.MissingMethodException’ with the Message: ‘Method not found: 'Void Microsoft.SharePoint.Publishing.ThreadSafeCache`2 .__AW_RemoveKey(System.Guid)'.’

We observed in this example, the original method name ‘RemoveKey’ was modified and tampered. Since we already knew that Microsoft.SharePoint.Publishing.dll does not have a method with the name “ __AW_RemoveKey”, so it was quite evident why the application failed with ‘System.MissingMethodException’. One of the ways the method names can be changed is by a Profiler.

So our next step was to see, if there is any active profiler hooked to the process. Usually that can be done from a .dmp or using Process Explorer or other tools. In our cases we were lucky to quickly find the profiler, as the first two letters of the name of the bad profiler matched exactly with the prefix “__AW_” of the missing method in question.

00000002`80000000 00000002`800ea000 awbadprofiler C (export symbols) awbadprofiler.dll

Loaded symbol image file: awbadprofiler.dll

Image path: C:\Victim Application\bin\awbadprofiler.dll

Image name: awbadprofiler.dll

 

Once we removed this bad profiler, application started working as expected!