Take the 2-minute tour ×
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It's 100% free, no registration required.

I'm "middle-new" in re and I have to debug a dll's function. How can I tell to IDA : start function XXX with parameters A, B and C ? Is there a solution or a plugin doing that ? I've tried doing that with rundll32.exe but unsucessfully.

I have no experience on ollydbg this is why I ask for a IDA solution

Thanks for helping !

share|improve this question
    
rundll32.exe should do it. You can set parameters in the debugger settings. –  Henno Brandsma May 5 at 13:35
add comment

2 Answers 2

up vote 3 down vote accepted

Based on this answer, rundll only supports running functions with a specific signature. I would recommend writing a simple executable that loads it. For example, in c, you could call LoadLibrary("yourdll.dll") and then GetProcAddress("yourfunc") and then call it that way. See MSDN (linked) for more info.

In IDA, you would then give your executable as the process, but your dll as the input file. That will allow you to set breakpoints that IDA will set when the dll is loaded. It also gives you control over the parameters since you can just pass them through from the command line.

share|improve this answer
    
Thanks, I wrote a executable using this mecanism and it works perfectly! =) –  user4559 May 8 at 9:44
add comment

IDA Pro has this mechanism called AppCall which basically allows you to set up the parameters of a function and call it directly.

Briefly, Appcall is a mechanism used to call functions inside the debugged program from the debugger or your script as if it were a built-in function. If you’ve used GDB (call command), VS (Immediate window), or Borland C++ Builder then you’re already familiar with such functionality.

Now , this might not be directly applicable to your situation, bit I guess creating a small wrapper program and using appcall on it could make things easier.

share|improve this answer
    
Thanks for answer, I didn't know AppCall system but it could be usefull. –  user4559 May 8 at 9:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.