I`m beginner in OllyDBG. In the debugging of an exe file, I found which dll is used (kernel32, ntdl, user32, etc). I want to get a list of all functions of each dll that are called. How?
Thanks a lot.
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
There are quite a few ways to achieve this.
In OllyDbg search for all Intermodular calls. This would bring up a list of functions called from the main module. You can the set a logging breakpoint on all the functions. The disadvantage of this approach is that dynamically resolved function calls cannot not be intercepted.
Search for Name in all modules. Next set logging breakpoints on all exported entries. Disadvantage of this approach is that there will be a lot of false positives such as when a function from kernel32 calls into another function in ntdll, it will be logged too. To clear the false positives you can use a conditional logging breakpoint to check if the return address is within the ranges of the main module.