0

I'm new to reverse engineering and recently met with a problem:

I have the dll and pdb of a debug version third party module, but I don't have its source codes. Now I want to write a piece of C++ code to test the stability and efficiency of the interfaces of the module, among which the functions are mainly unexported.

So my question is that how can I find the address of an unexported function and correctly call it from C++ with DLL and PDB?

1
  • You can get the function address by loading the DLL in Ghidra or IDA and get the function address (minus the base address). At run-time you need to add the base address of the DLL (which may change because of ASLR) and you have the full address of the function. Assuming the function doesn't expect special calling conventions you can then call it using the pointer.
    – Robert
    Jan 30 at 15:36

1 Answer 1

1

You have to:

1. Load the DLL into your process. In runtime, Windows' LoadLibrary api, will load the DLL and return a handle, which is the base address for the loaded module.

2. Get the address of the function you want to call from the .pdb, either manually or by using the provided pdb querying functions, as documented here:

https://learn.microsoft.com/en-us/visualstudio/debugger/debug-interface-access/idiadatasource-loaddatafrompdb?view=vs-2022

3. Cast the pointer to the the correct prototype and calling convention.

There is some pretty good information in this post: https://copyprogramming.com/howto/pdb-find-calling-function-code-example#calling-a-non-exported-function-in-a-dll

Note that while calling a simple function only requires the correct prototype and calling convention, a C++ function may very well depend on objects that in turn may need to be allocated, initialized or constructed in some way for the call to succeed (and not crash the whole process). The constructor(s) for these objects will likely (but not guaranteed to) be in the DLL.

.pdb files contain more debug information than mere function pointers. There should be more clues inside.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.