Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I have an executable with 2 .dll calls 1 of this dll is guard.dll others name is guardlib.dll both of them is encrypted c++ library file and they are called before executable entry point.
I can bypass anti-debug with x32dbg and now ı want to extract decrypted dll with debugger is that possible
Also this dlls are creating HWID with apı calls and registery keys (I think) Is there a way to have a look at what registry keys are looking for?
If anyone wants to help me please contact me :)
Instead of trying to dump the encrypted executable, it may be better to just monitor the API calls at runtime using something like Rohitab API Monitor. This is usually the easiest approach in cases where you can get the executable to run the code of interest. It also gives you the address of the calling code and call stack information, which you can then look at in your debugger in order to get a better idea of what's happening around the call site.
If you do need to dump the decrypted binary from memory, take a look at Process Dump. You can target the running process after the DLL decryption process has been completed and it'll produce a reconstructed PE file. It's also pretty good at recovering PEs that have been mangled in memory by anti-debug and anti-dumping tricks.
