1

I am trying to debug a dll by IDA but it have no exported functions so I can not use rundll32.exe to debug it. How can i do that?

Thanks so much./enter image description here

2
  • Just read the assembly...? /// What are you trying to do? It's a DLL so you can't run it directly anyway.
    – user202729
    Oct 5, 2018 at 13:17
  • If you got an answer you may want to consider posting a solution or accepting one of the posted answers.
    – NirIzr
    Oct 8, 2018 at 5:27

3 Answers 3

1

I believe you can still execute rundll32.exe without an exported function by just specifying rundll32.exe <dllpath>, (don't forget the comma). If I'm not mistaken this will load the DLL and execute the entry point.

2
  • Thanks for your answer. I tried before but a problem has occurred: "The instruction at 0x75DAEA5C referenced memory at 0xC. the memory could not be read -> 0000000C (exc.code c0000005, tid 1444)" Do you know why? Oct 4, 2018 at 3:43
  • 1
    I guess that's because there's an access violation within the executable.
    – NirIzr
    Oct 4, 2018 at 3:51
1

You can use regsvr32.exe. It will load the DLL (run the entry point) and then silently fail because there is no DllRegisterServer export.

1
  • Nice. I will try Oct 8, 2018 at 3:16
1

Implement the C application which loads your library, i.e. calls LoadLibrary().

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.