1

I have an exe file and a dll file. This exe file uses the dll to decode input file. This exe file is gui based and does not support command line execution.

So my requirement is to create a program which loads this dll and use the funciton to decode an input file so that I can use this program in some scripts.

The exe expects two inputs. Source file name and destination file name.

exe parameters

When I disassembled the exe, only 1 parameter is being passed to the dll function call, which is the source file name. I couldn't find how the destination file name is passed to the function.

dll function call in exe

Disassembly of dll function shows 2 exported functions.

dll exports

assembly code for dll function from IDA is as follows

convert2

While calling the dll function from exe, the stack is as follows

stack during function call

From this I understood that the a pointer to the source file name is passed as the argument. The pointer points to the following memory location. pointer stack contents

pointer memory contents

From this much information, is it possible to identify the function prototype of the dll function.

1

It’s hard to say for sure without full binary or all called functions but going by the debugger screens it looks like the argument is pointer to a structure with layout similar to the following:

struct PARAMS {
  char *inputfname;
  int flag1;
  char *outfname;
  int flag2;
};

There maybe other fields not obvious from the posted info, but you could try to start with this.

  • I created the program using LoadLibrary and GetProcAddress. I passed this struct as the argument, but the program was crashing. I used the following post as reference to create the program. MSDN: Using Run-time Dynamic Linking @igor – John Apr 24 '18 at 16:58
  • I can share more details of the program and the dll, if required – John Apr 24 '18 at 17:00
  • add the source of how exactly you call it – Igor Skochinsky Apr 24 '18 at 17:46
  • added the source code. added the exe, dll and input files also. – John Apr 25 '18 at 17:35
  • you should pass the struct by pointer. struct PARAMS1*. – Igor Skochinsky Apr 25 '18 at 18:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.