Being rather new to the concept of RE, I wanted to try and take a look at the assembly code in one DLL that I know exports some functions.
First, I used this tool - http://www.nirsoft.net/utils/dll_export_viewer.html - to obtain a list of exports within said DLL. These are some of the functions:
GI_Call 0x100590a7 0x000590a7 2 (0x2) mydll.dll I:\test\mydll.dll Exported Function GI_CleanReturnStack 0x10058eae 0x00058eae 3 (0x3) mydll.dll I:\test\mydll.dll Exported Function GI_Cmd_Argc 0x10058bd4 0x00058bd4 4 (0x4) mydll.dll I:\test\mydll.dll Exported Function GI_Cmd_Argc_sv 0x10059593 0x00059593 5 (0x5) mydll.dll I:\test\mydll.dll Exported Function
When I, however, load the DLL up in OllyDbg and browse to any of these addresses, I get instructions that don't really resemble a beginning of a function, for example GI_Call:
100590A7 10E9 ADC CL,CH 100590A9 CE INTO 100590AA FC CLD 100590AB FFFF ??? ; Unknown command 100590AD FF75 10 PUSH DWORD PTR SS:[EBP+10] 100590B0 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4] 100590B3 50 PUSH EAX 100590B4 57 PUSH EDI
What's even more puzzling is that once I scroll up/down, the code actually changes - there's no
100590A7 10E9 ADC CL,CH
anymore, it changes to a completely different instruction, also that address is gone.
Am I doing something wrong? Or is the DLL possibly encrypted? Though if it is, how could DLL Export Viewer dump the exports so easily?