2

Got into the hands of such a task. There are two dlls. As the second file was explained to me (new.dll) this is a new release of the first file (old.dll). Both files are compiled for x64. I need to find what a few functions from have turned into old.dll in new.dll. Below is an example of one of the functions. Please express your thoughts about my approach to finding a new version of the code: I started by using rdare2 to find all the functions in old.dll (more than 40 thousand), created a file with signatures and set it on a new file. In the end, nothing was found. I conclude that the changes are more than cosmetic. Next, I decided to search as follows:

  1. I do a search on the pieces of the function code. I take the prologue before calling the function and look for this sequence of bytes in new.dll.
  2. I try to find constants, strings, and other magic numbers that appear in the function and look for them in new.dll.
  3. I analyze all the functions that call the desired function and try to find a similar set of calling functions in new.dll.
  4. I try to determine the sequence of calling functions up to the very first (top) and find a similar sequence of calls in a new file.
  5. I analyze all the functions that are called from the desired function and try to find a similar set of called functions in new.dll
  6. Here I admit that all of the above did not help me. Next, I think that since there are such calls to call qword ptr [rax+18h] (there are 8 of them in the analyzed function), then these are probably calls to the methods of the object (s). You can probably find a vftable and understand what class these methods belong to and already make a set of classes.the method that is called in my function. Next, search in new.dll where such a sequence of methods from the corresponding classes is called.
  7. You can probably try to find where the object was created and where this this came from in my function. Next, look for a similar trace in new.dll. Not sure if this method can be applied without debugging this dll. It is not clear how to run the dll because there are only three exported functions: DllGetLCID PPMain DllEntryPoint

Which of the listed search approaches is utopia, and which is not? Maybe there are more proven options?

Improve this question

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.