0

Consider I have got a DLL file which contains some functions and classes that I am not aware of. It might be lack of documentation, or the unwillingness of the programmer to provide the documentation after the release. I want to know, how can I study an unknown DLL file and utilize it in my projects? ( Of course the programmer gives such permission )

Improve this question

1 Answer 1

Reset to default
4

I can't post comments for now, since I'm new on this forum

I'm not sure I fully understand your level of understanding here. Do you know some basic stuff in reversing field ?

If so, you should load your DLL in OllyDbg (for example) then click on Debug > Call DLL export to locate the API you're interested in. Then it's classic reversing session.

Otherwise, if you need more specifics, I strongly recommend you to buy "Secrets of reverse engineering - Eldad Eilam" book, in which there is a fully detailed example of a DLL reverse session.

Improve this answer
3
  • I am newbie in Reversing field. By the way, if I export the functions of interest, how can I know what parameters they exactly use? How can I gather some pieces of information on their usage? In addition, I have got the EXE file which utilizes that DLL. Is that EXE file an advantage? How can it be one? I am already reading the mentioned book but takes time to reach that topic.
    – FreeMind
    Jul 27, 2015 at 13:59
  • 1
    Well, that's a long process and explaining it here would take some time. I suggest you first write your own little simple programs, such as a printf, then load it into ollydbg, and try to understand the asm. Regarding the input arguments, assuming stdcall calling convention is used, you can see the "return" statement at the end of your function, followed by a number. This number indicates the size of the stack that needs to be cleared (i.e. calling arguments). Knowing that sizeof(arg) >= 4 bytes, you have at least this number/4 arguments sent to your prog. I have 1 char left to keep writing !
    – Hackndo
    Jul 27, 2015 at 15:03
  • 1
    EXE files using functions you are interested in can be useful, especially if you have access to the source code of these programs (I know you knew !). The important thing to remember is that reversing takes some time, and the more you have information about something you want to reverse, the best. If you can't gather everything you want by only reversing the DLL (maybe you won't know what type of variable are used), then reversing the .exe could be some useful help, since you have a context and you can guess when and why is this API used. Hope it gives you some usefule pieces of information !
    – Hackndo
    Jul 27, 2015 at 15:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.