1

I'm new to reverse engineering, I want to find out which command in the Source2 Engine's console invokes which function (and in which DLL). For that, I was wondering how can I know:

  1. which functions are called from which DLL in runtime.
  2. Is there a debugger that lets me know what code was executed between two timestamps?

Thanks in advance!

  • Can you provide more details in your question? For example, are you working in a Windows environment and what kinds of programs are you looking at? More information in the question will help others provide better answers. – julian Feb 14 '17 at 20:56
  • Yeah, Windows environment. Well my specific goal from what this question derived from is to find out which function in console of the Source2 Engine invokes which function in which dll. ( damn 3 "which"es ) – TehAbstraCt Feb 14 '17 at 21:24
  • 1
    It's better to edit in new information, instead of comment it. – NirIzr Feb 14 '17 at 22:15
  • I did this for you this time, next time you're on your own! ;) – NirIzr Feb 14 '17 at 22:21
3

Looks like you're looking for process monitoring tools. Those are tools that use techniques like Hooking (and similar) to generate a runtime list of APIs or events caused by the monitored process.

First, I would like to recommend the set of tools coming with Microsoft's Sysinternals suite. Specifically, Process Monitor, which is a tool that monitors file, network, registry and process manipulation events. It has several filtering abilities and is generally pretty nice and very well known. The sysinternals suite includes many other relevant tools, and you should definitely get comfortable with it if you're interested in reverse engineering.

Second, personally I'm a huge fan of Rohitab's API Monitor. It has multiple API hooking engines and collects full information of each API. It has extensive filtering but might be a bit overwhelming at first if many APIs are selected for monitoring. It's a great place to start investigating a piece of software!

EDIT

Although both tools are extremely helpful, they won't be able to log internal functions, such as functions inside the main executable or accompanying dlls. Or any function that the tool isn't familiar with before hand. This is because in order for API hooking to work, you generally need:

  1. The function should be exportable from an executable and
  2. The API hooking code should be familiar with the parameters the function accepts.

It appears you indeed need a debugger for this task, if you're after logging internal calls. Most good reverse engineering debuggers (such as ollydbg and x64dbg) come with functionality to trace and log all function calls. This might be a good start.

  • I was aware of Process Monitor, however I did not find the option to check out which functions are being invoked. Will definitely check out Rohitlab's API monitor as it seems to do the job I want it to do. Thanks for the information! – TehAbstraCt Feb 14 '17 at 21:22
  • Btw do you know some good materials to get me started on hooking, I cloned a few projects, however I am mostly a web developer, recently started with .NET, meaning no "low-level" programming, and from what I see all are written in C/C++, in which I have no prior experience. – TehAbstraCt Feb 14 '17 at 21:27
  • 1
    To understand how API hooking works and to be able to implement API hooking code you'll have to get decent understanding of low level programing (AKA C/C++), and probably assembly as well. – NirIzr Feb 14 '17 at 22:14
0

This isn't an exact match but a while back I wrote this https://github.com/marshalcraft/CheapoDllDependencyTool/blob/master/CheapoDllDependencyTool/bin/Debug/CheapoDllDependencyTool.exe

It's on my GitHub and will list the first generation of dependent DLL's provided an executable or dll. It's pretty basic and can't remember if I list functions or not.

There have to be much better implementations than mine I bet but this minimally works for things like seeing if web browser relies in ws2 WinSock or other things when you want to get an idea of what apis to use to do something.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.