0

If this is the wrong spot for this, or is a duplicate, let me know.

I'm a computer professional getting started with decompiling and reverse engineering just for fun and resume building. I have a decent grasp of assembly, but I'm still learning. If this is a dumb question, let me know why it's dumb.

I'm looking to bypass a problematic DLL in an win32 application. I tried letting the DLL run, then setting all the jumps in the main app via debugging, but memory access errors are being thrown. I'm pretty sure it's doing more than just returning values in AX.

Questions:

  • Is there a way I can run the program, save all the memory / stack ops done by the dll? Maybe a trace of some kind?

  • What tool could do this (Ollydbg, IDA, MS Detours)?

  • Is this a productive way to approach the problem?

If I did this, I would have a success case. I could then re-code the DLL with op code to do what it needs to do and replace the rest with no-ops. Haven't had much luck with this on Google.

  • how does the dll gets loaded is it dynamically loaded during runtime? – Paweł Łukasik Oct 2 '17 at 5:07
  • Yes, it's loaded dynamically. – user21814 Oct 2 '17 at 14:53
  • Can I ask the community what I could've done to better word this question? I had thought other beginners could benefit from an answer to this. I did quite a lot of research and couldn't find a answer on my own. – user21814 Oct 3 '17 at 19:53
3

I think you should look into API hooking. This page will go into detail about API hooking. In your case I would create a DLL library and inject it to the target process (either when the target loads or whenever it is already loaded). Your library should then detour the calls to the original function to your proxy method.

  • Very concise article, thank you. Do you think my errors would be solved by removing the original DLL and replacing it with a hook? – user21814 Oct 2 '17 at 14:28
  • 1
    Yes, from what I understood of your main post this is exactly what you need. Also, you are not going to remove the original DLL; you are letting it load and intercept the calls to the original DLL and proxy them to your custom DLL. – Jevgeni Geurtsen Oct 2 '17 at 14:44
  • The thing is, I'm pretty sure this DLL allocates memory in some of its functions. Simply returning the correct value won't help me. How can I determine how to replicate what it does in my hook? – user21814 Oct 2 '17 at 20:12
  • What do you mean by allocating memory? Does it store some variables or does it inject code on runtime (probably not, but I think u get the idea). Did u read about detours? You can set the detour at any given moment in the function, so you could first let the original code (partly) run and then call your own proxy. – Jevgeni Geurtsen Oct 3 '17 at 6:52
  • It looks like it might be doing some string comparison. Also, there's quite a bit of moving things into and from memory. I just want to get a high level understanding of how to solve the problem :) Detours is something I'm going to check out soon. – user21814 Oct 3 '17 at 15:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.