I have EXE file which calls one specific DLL among other system DLLs. When I change a string value in this specific DLL I can see the changes when I execute the EXE file. For example I can change text that appears in a message box and it will work, but when I debug it using X32DBG(v.28jan2018) I can't find any references of the DLL in X32DBG's module tab, even though my changed message box appears as expected. Why can't X32DBG see this DLL? I turned on the breakpoints on any system events and tried to debug manually but I don't see the DLL.

  • Is the DLL referenced in the EXE's import table? If not, it could be that the DLL is loaded on the fly (LoadLibary), the code executed (GetProcAddress) and the DLL unloaded. If that's the case there's only a very small window where it would be visible in the module list. And finally, if your EXE manually maps the DLL it doesn't have to be visible at all. – Johann Aydinbas Nov 3 '19 at 21:30
  • You can set a DLL breakpoint on the name of your DLL to check Johann’s theory. – mrexodia Nov 6 '19 at 8:51
  • @Johann Aydinbas Sorry for late answer. Thank you. I can't find my DLL in the Symbols tab and I can't see it during debuging. For this purpose I used Procmon and I looking for when it calls DLL's folder. He does, but unfortunately I can't find where exactly. – EvilCracker Nov 9 '19 at 0:48
  • @mrexodia I did, but it complitelly ignores. :( This answer doesn't help. reverseengineering.stackexchange.com/questions/15572/… – EvilCracker Nov 9 '19 at 0:51
  • Perhaps take a look with process monitor to see where the dll is used in the process. – mrexodia Nov 9 '19 at 0:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.