3

I'm "middle-new" in re and I have to debug a dll's function. How can I tell to IDA : start function XXX with parameters A, B and C ? Is there a solution or a plugin doing that ? I've tried doing that with rundll32.exe but unsucessfully.

I have no experience on ollydbg this is why I ask for a IDA solution

Thanks for helping !

  • rundll32.exe should do it. You can set parameters in the debugger settings. – Henno Brandsma May 5 '14 at 13:35
4

Based on this answer, rundll only supports running functions with a specific signature. I would recommend writing a simple executable that loads it. For example, in c, you could call LoadLibrary("yourdll.dll") and then GetProcAddress("yourfunc") and then call it that way. See MSDN (linked) for more info.

In IDA, you would then give your executable as the process, but your dll as the input file. That will allow you to set breakpoints that IDA will set when the dll is loaded. It also gives you control over the parameters since you can just pass them through from the command line.

  • Thanks, I wrote a executable using this mecanism and it works perfectly! =) – user4559 May 8 '14 at 9:44
3

IDA Pro has this mechanism called AppCall which basically allows you to set up the parameters of a function and call it directly.

Briefly, Appcall is a mechanism used to call functions inside the debugged program from the debugger or your script as if it were a built-in function. If you’ve used GDB (call command), VS (Immediate window), or Borland C++ Builder then you’re already familiar with such functionality.

Now , this might not be directly applicable to your situation, bit I guess creating a small wrapper program and using appcall on it could make things easier.

  • Thanks for answer, I didn't know AppCall system but it could be usefull. – user4559 May 8 '14 at 9:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.