4

I've been attempting to build my own implementation of Nvidia's Surround functionality by using their DLLs within a more reliable and automatic system. I'm pretty new to this; I've been a programmer for a while, but I've never had need to do any reverse engineering like this, so apologies if I'm being profoundly dumb.

So far I have managed the following:

  • Found the names and addresses of the exported functions that relate to what I want to do inside NVCPL.dll.
  • Found the only exe that seems to load in a copy of that DLL (nvcplui.exe).
  • Using API monitor, I found an instance of one of the DLL's functions being called at what seems to be the right time.
  • Put break points in the assembly of nvcpl.dll whilst attached to nvcplui.exe via x64_dbg

Where I'm stuck:

When I was using API monitor, I couldn't seem to catch any direct calls to the function I was looking at (NvCplApiDisableSpan), I only ever found it in the stack before a wndproc call. Also, the break points that I placed in and around that function never get triggered.

My current thoughts are that I'll need to "see" the assembly of the function being called so I can get to the next step of figuring out how to shape my calls to that function correctly.

I thought perhaps that the function was being called by a different process, having being triggered to do so by nvcplui.exe, but according to procexp that's not the case; nvcplui.exe is the only process using that dll.

Any advise you have for me would be greatly appreciated; I'm not averse to doing my homework, but I can't see a way forward without maybe getting hold of a copy of IDA, however, that's a little outside my budget.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.