I have a program (P.exe) with several dependencies (A.dll, B.dll etc). I decompiled and studied B.dll, but at runtime, P.exe is using A.dll. The horizon is updating in ISA view-RIP, but I don't have the decompiler view.

How can I get the decompiled view of A.dll, where the horizon is ?

Using IDA pro 7.5

  • What do you mean by “horizon”? – Igor Skochinsky Jan 26 at 8:08
  • Horizon or RIP, ie., where the execution is located – Soleil Jan 26 at 14:24

One simple way is to take a snapshot of the process memory and then work with it since it includes the modules.

Another is to create a database with all the modules, as described: https://www.hex-rays.com/blog/several-files-in-one-idb-part-3/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.