1

I am trying to debug a dll by IDA but it have no exported functions so I can not use rundll32.exe to debug it. How can i do that?

Thanks so much./enter image description here

  • Just read the assembly...? /// What are you trying to do? It's a DLL so you can't run it directly anyway. – user202729 Oct 5 '18 at 13:17
  • If you got an answer you may want to consider posting a solution or accepting one of the posted answers. – NirIzr Oct 8 '18 at 5:27
1

I believe you can still execute rundll32.exe without an exported function by just specifying rundll32.exe <dllpath>, (don't forget the comma). If I'm not mistaken this will load the DLL and execute the entry point.

  • Thanks for your answer. I tried before but a problem has occurred: "The instruction at 0x75DAEA5C referenced memory at 0xC. the memory could not be read -> 0000000C (exc.code c0000005, tid 1444)" Do you know why? – Noiua Asrui Oct 4 '18 at 3:43
  • 1
    I guess that's because there's an access violation within the executable. – NirIzr Oct 4 '18 at 3:51
1

You can use regsvr32.exe. It will load the DLL (run the entry point) and then silently fail because there is no DllRegisterServer export.

1

Implement the C application which loads your library, i.e. calls LoadLibrary().

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.