4

I found a github project that compiled cleanly on the first try (might be the first ever for me, yay!). No instructions, so I stumble around for a bit until I find an awful Youtube video... everything's going good, until I hit the two minute mark, and then it has a section titled "Open in IDA Pro 64".

I took a look at their website... $589 and up. It's sort of over-the-budget given the nature of this personal project.

Is there a dll proxy tool/system that would just write out the calls/args to a log file or something of that nature?

Improve this question
4
  • Maybe you should first tell us what project it is you are talking about?
    – Willem Hengeveld
    Commented Nov 3, 2016 at 16:32
  • @WillemHengeveld I have a personal project that involves proxying a single windows dll. Given the legal nature of the DMCA, practically any interesting question I could ask here is violating some law or another, and I'm hesitant to give spurious details that don't much change any of the answers you might give. If that's wrong of me, what sort of details might you like me to provide?
    – John O
    Commented Nov 3, 2016 at 16:38
  • 1
    I mean what is that github project you are talking about.
    – Willem Hengeveld
    Commented Nov 3, 2016 at 17:15
  • github.com/zeroKilo/ProxyDllMaker
    – John O
    Commented Nov 3, 2016 at 17:48

2 Answers 2

Reset to default
2

Looks like you're looking for an API monitoring tool. There are plenty of those, including my personal favorite being Rohitab's API Monitor.

An API monitoring tool will record all API calls performed by a process, thier parameters and return values. Features depend on the specific tool but Rohitab's is really complete (and free). Googling for API monitoring tools will provide other good results.

Additionally, IDA has both a limited demo version and an old freeware version. One of those is ought to be enough for what you seem to be looking for.

Improve this answer
3
  • Alternatively, you could try WinAPIOverride.
    – Dominik Antal
    Commented Nov 4, 2016 at 14:40
  • This is a Safedisc protected product (though, interestingly, not a video game). Supposedly it has anti-IDA features. I've tried API Monitor, and while it recognizes that the program has started and asks if I want to monitor it, it never shows the dll as having been used/invoked. I'm not sure if I'm not using it correctly, or if it's got anti-debugging magic.
    – John O
    Commented Nov 4, 2016 at 15:33
  • APIMonitor has multiple monitoring techniques. I often find that when one falls other succeed but if the program is protected you should remove the protections before doing anything else imo
    – NirIzr
    Commented Nov 4, 2016 at 15:36
1

This project here generates Visual Studio code for building plain proxy dlls:

https://github.com/mavenlin/Dll_Wrapper_Gen

It's based off an older project called "wrapit", which also generates VS code, but takes a little more work:

http://www.codeproject.com/Articles/16541/Create-your-Proxy-DLLs-automatically

I've had some luck with both, they generate valid code that I can build DLLs with. As these are native, functioning DLLs, they should avoid any trouble with anti-debugger code that detects a debugging process hooking in (though, there are conceivably counter-measures that could defeat this attempt too).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.