1

If I have injected my own DLL into an executable (a game specifically) which imports a DLL to draw its graphics, camera, etc. How can I go about calling the DLLs functions?

I'm able to find the executables functions and hook them/call them at will, but I'm having trouble wrapping my head around how to do the same thing for the DLL which has the real goodies I want to call/manipulate.

I'm using IDA Pro to decompile the executable to get a good sense of what's happening. I'm still a beginner at this stuff but I think the dword_xxxx references is when the executable is calling DLL functions? Things like this for example:

enter image description here

Improve this question

1 Answer 1

Reset to default
1

I guess you need the base address of the loaded DLL to install your hooks. You can simply call GetModuleHandleA/W if the DLL is already loaded or LoadLibraryA/W if the DLL is loaded later. Once you get the base address, you have to add the RVA to this value, and you'll have the virtual address. Or you can use GetProcAddress to retrieve the virtual address of the exported functions.

Regarding your screenshot, I didn't get it sorry. But I can't see any call instruction. I guess this is a pointer store in a global value. Probably not related to a DLL.

Improve this answer
5
  • I see. That makes more sense.
    – Nikita Buyevich
    Mar 1, 2019 at 19:43
  • Hmm so now I'm able to find specific addresses in the external DLLs but everything is obfuscated. What would be the best way for me to find say the camera function? My main goal is to detach the camera from the player in the game and control it at will.
    – Nikita Buyevich
    Mar 1, 2019 at 19:43
  • If the DLL is obfuscated, it means it was provided by the game vendor. Normally, graphics library (e.g. DirectX, OpenGL, Vulkan, ...) are not obfuscated. I suggest you identify which library draws 3D scenes and its version, figure out the camera API, and finally see how the game engine uses it.
    – wisk
    Mar 1, 2019 at 20:07
  • Yes it's their own DirectX implementation. So you're suggesting I look into DirectX into a non-obfuscated build of it and try to see their implementation of the camera to see how their version of DirectX does it?
    – Nikita Buyevich
    Mar 1, 2019 at 20:30
  • Yes. However, since this is based on DirectX, it can be more challenging to deal with COM (Component Object Model).
    – wisk
    Mar 8, 2019 at 0:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.