0

I'm working on a project which requires me to extract, edit, and reproduce part of a proprietary hash algorithm.. which is contained inside a dll.

The dll is used by an Unity game, and includes Unity between its references too.

This dll invokes some external functions contained in another dll (which I suppose has been written in c++, considering the DllImport etc present in the source code) with all the real hash logic and methods... and here comes the problem.

I've not been able to find and locate that dll: no trace in the folder at all.

So I suppose that Unity (or whatever tool) managed somehow to embed it inside the dll code itself... but after further decompilation, disassemblation etc, the dll does not present any code to eventually extract it!

The fact is that ILSpy is able to show this external dll in the "parent" dll references, marking it as a "module", but I have no idea about how to proceed to extract it (if it's relly there!).

I also tried to bypass the problem, including the entire dll into a C# project, and invoking its public functions at runtime (like the Unity game does)... but it seems that somehow, this idea is not working at all (read something about the fact that unity can run c# code, but I cannot init Unity via C#... or something like that).

So... After struggling for days, I decided to ask here to some experts.

Anyone can help me?

2

This dll invokes some external functions contained in another dll (which I suppose has been written in c++, considering the DllImport etc present in the source code) with all the real hash logic and methods... and here comes the problem.
I've not been able to find and locate that dll: no trace in the folder at all.

Use Process Explorer or Process Hacker to find which modules are loaded in the address space of the process. When you find the required dll, check whether there exists a valid path for that module in disk. If there is one then you may simple copy over the dll for further analysis. Otherwise the dll may have been loaded from memory. In such case you have to dump that dll from memory.

Next using a PE detection tool such as ExeInfo PE , Detect It Easy scan the dll. If it is a managed DLL (aka .net) check if a .net decompiler such as dotPeek or reflector can decompile it readily. If it is obfuscated, try using de4dot before decompiling.

If it is a native dll IDA Pro is your best option for analyzing the dll.


There are quite a few ways to package a dll inside an executable.

  • For native dlls to be embedded inside native executables, you can simply store them as resources, which will be written to disk at runtime and loaded subsequently. Another way is to load it completely from memory as said previously.
  • For native dlls to be embedded inside managed executables, you may use the resource method.
  • For managed dlls to be embedded inside managed executables, you may use the resource method, but writing it to disk is not needed.

See this article on loading a dll from embedded resource for more info.

  • Unlucky I cannot dump memory unless tools such those you named are available for Android too (as the dll is used by an Unity mobile game, I forgot to mention it). Already tried to check for path at runtime, and also analyzing the dll with dotPeek and Reflector exposed nothing more than those external calls... without actually having access to the un-managed dll at all. – W00dL3cs Sep 8 '14 at 15:13
  • @W00dL3cs Please add the android tag then. For Android it would be a Shared Object (.so) not a dll. Also check this page. – 0xec Sep 9 '14 at 4:45
  • @W00dL3cs If you have got the apk of the game, Open it in a Archive Editor like WinRAR, and check in the following directory Assets->Plugins->Android whether the required file exists. – 0xec Sep 9 '14 at 4:55
  • It sounds like the android app is using mono so it could well be a DLL rather than a shared object. – Ian Cook Sep 9 '14 at 7:01
  • I scraped the content of the .apk, and found a .so file with similar name as the dll referenced in the main one... the fact is that decompiling such dll exposes external calls to another dll, not to a shared object! – W00dL3cs Sep 9 '14 at 8:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.