Solving method of DLL crackme

Question

I was given two DLL files (link) . The task is to get the flag from them. First what I've done - opened the first file (called original) in IDA and found the function called _GetFlag.

As I understood, I need to call that function from the DLL library somehow (that's the first question - I don't have any info about the function except its name, so I'd like to know how exactly I can call it). However, as wee see, even if I knew how to call it, we can't get the flag from original DLL, it says Sry, flag is in the patched version.

Ok, I opened patched DLL in IDA. First what we see that the file can be opened only as a binary:

As always, I opened the Strings window and we see the string "0day is bring your own header day! Flag is: %s" . It looks like a key for solution.

However, I don't exactly know what to do after that. I'd really appreciate if somebody would explain me how to solve this.

Answer 1

Once you have patched the malformed bytes to make the patched DLL proper, you can use something like this to call the GetFlag function.

#include <Windows.h>

typedef DWORD (__cdecl *_GetFlag)();
_GetFlag GetFlag;
HMODULE hDll = NULL;

NTSTATUS main(int argc, char **argv) {
    hDll = LoadLibrary("my_head_flew_away_patched.dll");
    GetFlag = (_GetFlag)GetProcAddress(hDll, "GetFlag");
    GetFlag();
}