1

I have an executable with 2 .dll calls 1 of this dll is guard.dll others name is guardlib.dll both of them is encrypted c++ library file and they are called before executable entry point.

I can bypass anti-debug with x32dbg and now ı want to extract decrypted dll with debugger is that possible

Also this dlls are creating HWID with apı calls and registery keys (I think) Is there a way to have a look at what registry keys are looking for?

If anyone wants to help me please contact me :)

1

Instead of trying to dump the encrypted executable, it may be better to just monitor the API calls at runtime using something like Rohitab API Monitor. This is usually the easiest approach in cases where you can get the executable to run the code of interest. It also gives you the address of the calling code and call stack information, which you can then look at in your debugger in order to get a better idea of what's happening around the call site.

If you do need to dump the decrypted binary from memory, take a look at Process Dump. You can target the running process after the DLL decryption process has been completed and it'll produce a reconstructed PE file. It's also pretty good at recovering PEs that have been mangled in memory by anti-debug and anti-dumping tricks.

1
  • Thank you so much dude ı will try this suggestions . – eray erkol Dec 8 '20 at 21:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.