9

I'm fairly new to the RE world, started right around a week and have gotten my hands dirty with some really good stuff on this website. Pardon my naive knowledge.

Currently, I'm trying to reverse a DLL file of a certain EXE. The EXE makes calls to functions of this DLL for looking up certain values which I plan to patch eventually.

How do I go about debugging the DLL while the application is running?

I would like to be able to place a break point in my DLL and get a hit in IDA Pro while the call is made from the application.

Right now, I patch the DLL by simply hoping for it to work, but I'm pretty sure that there exists a much productive method.

I'm using IDA Pro as my flavor of tool. You could suggest me if some other disassembler can help me achieve the same.

Could someone be kind enough to guide me around this task?

19

Very easy, if I got you right:

  1. Make an Ida project from the DLL, i.e. drag and drop the dll into the blank Ida page.
  2. In Menu Debugger, Process Options, put the path to your exe into the textbox "Application", Into "input file" put the path to your DLL. Confirm with OK.
  3. Start with menu Debugger, Start Process or F9.

Your breakpoint should be hit.

  • Exactly what I was looking for. Is it possible for me to debug the DLL when the application is already running as a process? – Pramod Mohandas Jul 11 '15 at 21:17
  • Menu Debugger, Attach to Process... – josh Jul 11 '15 at 22:31
  • 1
    Any way to show the database, decoded structs and function names and so on, for both the DLL and EXE modules at the same time? – Nuzzolilo Jul 4 '16 at 18:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.