0

I'm new here so I'm sorry if this isn't the right section for my question.

I'm reverse engineering a software that's written in .net 3.5 c# which loads a weird dynamic dll, which has an important functionality of decrypting / encrypting strings. I tried to make a c# program and import the dlls but visual studio complains about invalid / unsupported dll.

Here is some output and info:

targetframework: .Net Framework v3.5 
FileAnalyzer.dll:  PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

the .net software loads it and hooks its functions like this:

 public class FileDataCtrlWrap
  {
    [DllImport("FileDataCtrl.dll", CharSet = CharSet.Ansi, CallingConvention = CallingConvention.StdCall)]
    private static extern bool GetPersonalSettingsFolder(byte[] buffer, uint type);

    [DllImport("FileDataCtrl.dll", CharSet = CharSet.Ansi, CallingConvention = CallingConvention.StdCall)]
    private static extern bool GetSettingsFolder(byte[] buffer, uint type);

    [DllImport("FileDataCtrl.dll", CharSet = CharSet.Ansi, CallingConvention = CallingConvention.StdCall)]
    private static extern bool GetSnapShotFolder(byte[] buffer);

    [DllImport("FileDataCtrl.dll", CharSet = CharSet.Ansi, CallingConvention = CallingConvention.StdCall)]
    private static extern bool GetSnapShotPath(string cameraName, byte[] buffer);

    [DllImport("FileDataCtrl.dll", CharSet = CharSet.Ansi, CallingConvention = CallingConvention.Cdecl)]
    private static extern int Encrypt(string intput, StringBuilder output);
...
...
..etc
  1. How is this .net program loading a pe32 dll?
  2. Is it possible to replicate this behavior? If not what are the alternatives?

the dll file can be found here

1
  • Is your app targeted to x86 or x64?
    – Igor Skochinsky
    May 5, 2020 at 6:32

1 Answer 1

1

You can't load 32bit Dlls in 64bit Processes

Solution: build a 32bit App or write an external 32bit prozess(yes a EXE) that loads the DLL and communication with that process using Pipes or TCP/IP from your 64bit app

btw: the first Dlls name is FileAnalyzer.dll, in the Code is FileDataCtrl.dll?

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .