Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I've loaded a program into IDA + Hex-Rays, and decompiled it down to some C-like pseudo-code. Now, I am trying to figure out, for a single action that I am taking in the program, what code is being run. The code that I am interested in comes from a DLL the program uses.
How does one go about tracing something like, "I click on this button, this is the code that corresponds to it"?
What you are really looking for is a debugger. GDB for Linux or OllyDbg for windows PE's. Get to the point where you want to click a button on the program and then conduct a trace from there. You should be able to see all the instructions executed immediately following you "clicking the button". You can then identify what code is being executed and go back to IDA to look at it there.
You can load your executable that loads the DLL using OllyDbg or Immunity Debugger.
You can then check which modules imported are loaded via View->Executable Modules or with the keyboard shortcut Alt+E (at least on Immunity Debugger).
Then, select your DLL which was imported and right click it. Select View Names or hit Ctrl+N.
You will be prompted with a sub menu where you can select the DLL's export you are interested in. Select the export and hit F2 to set a software breakpoint on it or right click and select Toggle Breakpoint.
When you run your program, hopefully, your DLL import will be called and your breakpoint will be hit, pausing execution. You can then view your call stack with View->Call Stack or you can use the shortcut Alt+K. You will likely be interested in the returns to column because that will represent the address where your DLL import will return to. Note that the most recently called functions will be located on the top of the stack.
You can then use IDA to search for that address in the disassembly. When you are in graph view, press g and paste the address that you copied from the returns to column from the call stack in your debugger.
Happy hunting! :)
