0

I'm new here so I'm sorry if this isn't the right section for my question.

I'm reverse engineering a software that's written in .net 3.5 c# which loads a weird dynamic dll, which has an important functionality of decrypting / encrypting strings. I tried to make a c# program and import the dlls but visual studio complains about invalid / unsupported dll.

Here is some output and info:

targetframework: .Net Framework v3.5 
FileAnalyzer.dll:  PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

the .net software loads it and hooks its functions like this:

 public class FileDataCtrlWrap
  {
    [DllImport("FileDataCtrl.dll", CharSet = CharSet.Ansi, CallingConvention = CallingConvention.StdCall)]
    private static extern bool GetPersonalSettingsFolder(byte[] buffer, uint type);

    [DllImport("FileDataCtrl.dll", CharSet = CharSet.Ansi, CallingConvention = CallingConvention.StdCall)]
    private static extern bool GetSettingsFolder(byte[] buffer, uint type);

    [DllImport("FileDataCtrl.dll", CharSet = CharSet.Ansi, CallingConvention = CallingConvention.StdCall)]
    private static extern bool GetSnapShotFolder(byte[] buffer);

    [DllImport("FileDataCtrl.dll", CharSet = CharSet.Ansi, CallingConvention = CallingConvention.StdCall)]
    private static extern bool GetSnapShotPath(string cameraName, byte[] buffer);

    [DllImport("FileDataCtrl.dll", CharSet = CharSet.Ansi, CallingConvention = CallingConvention.Cdecl)]
    private static extern int Encrypt(string intput, StringBuilder output);
...
...
..etc
  1. How is this .net program loading a pe32 dll?
  2. Is it possible to replicate this behavior? If not what are the alternatives?

the dll file can be found here

1
  • Is your app targeted to x86 or x64?
    – Igor Skochinsky
    May 5 '20 at 6:32
1

You can't load 32bit Dlls in 64bit Processes

Solution: build a 32bit App or write an external 32bit prozess(yes a EXE) that loads the DLL and communication with that process using Pipes or TCP/IP from your 64bit app

btw: the first Dlls name is FileAnalyzer.dll, in the Code is FileDataCtrl.dll?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.