4

I found a github project that compiled cleanly on the first try (might be the first ever for me, yay!). No instructions, so I stumble around for a bit until I find an awful Youtube video... everything's going good, until I hit the two minute mark, and then it has a section titled "Open in IDA Pro 64".

I took a look at their website... $589 and up. It's sort of over-the-budget given the nature of this personal project.

Is there a dll proxy tool/system that would just write out the calls/args to a log file or something of that nature?

4
  • Maybe you should first tell us what project it is you are talking about? Nov 3 '16 at 16:32
  • @WillemHengeveld I have a personal project that involves proxying a single windows dll. Given the legal nature of the DMCA, practically any interesting question I could ask here is violating some law or another, and I'm hesitant to give spurious details that don't much change any of the answers you might give. If that's wrong of me, what sort of details might you like me to provide?
    – John O
    Nov 3 '16 at 16:38
  • 1
    I mean what is that github project you are talking about. Nov 3 '16 at 17:15
  • github.com/zeroKilo/ProxyDllMaker
    – John O
    Nov 3 '16 at 17:48
2

Looks like you're looking for an API monitoring tool. There are plenty of those, including my personal favorite being Rohitab's API Monitor.

An API monitoring tool will record all API calls performed by a process, thier parameters and return values. Features depend on the specific tool but Rohitab's is really complete (and free). Googling for API monitoring tools will provide other good results.

Additionally, IDA has both a limited demo version and an old freeware version. One of those is ought to be enough for what you seem to be looking for.

3
  • Alternatively, you could try WinAPIOverride. Nov 4 '16 at 14:40
  • This is a Safedisc protected product (though, interestingly, not a video game). Supposedly it has anti-IDA features. I've tried API Monitor, and while it recognizes that the program has started and asks if I want to monitor it, it never shows the dll as having been used/invoked. I'm not sure if I'm not using it correctly, or if it's got anti-debugging magic.
    – John O
    Nov 4 '16 at 15:33
  • APIMonitor has multiple monitoring techniques. I often find that when one falls other succeed but if the program is protected you should remove the protections before doing anything else imo
    – NirIzr
    Nov 4 '16 at 15:36
1

This project here generates Visual Studio code for building plain proxy dlls:

https://github.com/mavenlin/Dll_Wrapper_Gen

It's based off an older project called "wrapit", which also generates VS code, but takes a little more work:

http://www.codeproject.com/Articles/16541/Create-your-Proxy-DLLs-automatically

I've had some luck with both, they generate valid code that I can build DLLs with. As these are native, functioning DLLs, they should avoid any trouble with anti-debugger code that detects a debugging process hooking in (though, there are conceivably counter-measures that could defeat this attempt too).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.