I started reversing a 32-bit x86 EXE that led me down the path of finding the structure and core functions I needed inside of a DLL. I'm currently using Binary Ninja 3.5 as my disassembler, decompiler, and debugger.

Having the DLL analyzed, a lot of the pieces became much clearer and I've been able to annotate quite a bit. The problem I am running into is that I still need to debug the EXE to see the paths it takes and values it's working with in order to find and fix the issue I am trying to track down.

For instance DLL.MethodA @ 0x10000000 could end up being loaded and ran from 0x020000 when debugging the EXE, but all of the symbols I imported are based around the 0x10000000 addresses.

Once the debugger runs that method from memory, all the analyses I've done before is non-existent and if I do re-annotate it while debugging, it's lost as soon as I stop debugging.

I hope that's clear because it was shockingly hard to try and write this out for some reason.

Am I missing an option in Binary Ninja that solves this issue? Is this something that would be better dealt with by OllyDbg or x64dbg or anything else? I'm not really sure what the RE process looks like when working with a DLL and trying to do runtime analyses.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.