I'm "middle-new" in re and I have to debug a dll's function. How can I tell to IDA : start function XXX with parameters A, B and C ? Is there a solution or a plugin doing that ? I've tried doing that with rundll32.exe but unsucessfully.
I have no experience on ollydbg this is why I ask for a IDA solution
Thanks for helping !
Based on this answer, rundll only supports running functions with a specific signature. I would recommend writing a simple executable that loads it. For example, in c, you could call LoadLibrary("yourdll.dll") and then GetProcAddress("yourfunc") and then call it that way. See MSDN (linked) for more info.
In IDA, you would then give your executable as the process, but your dll as the input file. That will allow you to set breakpoints that IDA will set when the dll is loaded. It also gives you control over the parameters since you can just pass them through from the command line.
IDA Pro has this mechanism called AppCall which basically allows you to set up the parameters of a function and call it directly.
Briefly, Appcall is a mechanism used to call functions inside the debugged program from the debugger or your script as if it were a built-in function. If you’ve used GDB (call command), VS (Immediate window), or Borland C++ Builder then you’re already familiar with such functionality.
Now , this might not be directly applicable to your situation, bit I guess creating a small wrapper program and using appcall on it could make things easier.
