0

I'm currently analyzing a complex software which compiles a kind of code. By monitoring and correlating it with ProcMon I could figure out it loads a DLL as a module.

Now I'm trying to find out how exactly it is compiling the code by using a specific DLL (and which of its function together with its output) so I would like to ask which is the best way to do this.

I have IDA Pro and know it has the capability to debug it together with an exe. The problem is the software consists of multiple subprocesses (or exes) so I don't know which one is using it exactly or how to handle such cases.

Is there any way you can recommend or reference I could start with? I was considering using processhacker together with "ThreadCreate" Operations but don't know if ProcessHacker is the right tool for this as it doesn't record anything and has only a real-time view.

Thanks

1 Answer 1

0

If I've understood correctly, you are trying to figure out how the functions in this dll are called from the main executable.

If that's the case you can use API Monitor by Rohitab, a free tool to "spy" access to dll functions. This tool is very powerful, and it allows you to retrieve the thread id, the name of the DLL that made the call, the API itself with its parameters and return value.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.