Skip to main content

Questions tagged [dll]

Dynamic-link library, or DLL, is Microsoft's implementation of the shared library concept in the Microsoft Windows and OS/2 operating systems.

Filter by
Sorted by
Tagged with
0 votes
1 answer
57 views

DLL exports same function with multiple names

When ntdll.dll is loaded in x64dbg, I see that there can be multiple symbols at the same address. For example; As far as I know, there is no way to achieve something like this using regular msvc ...
yasar's user avatar
  • 103
2 votes
1 answer
135 views

How to detect obfuscator and where to dig?

I have an .net assembly application written on c# Its target framework version is 4.5.2 Trying to decompile with ILSpy, mostly all files looks like this: using MyApp.Controller; using MyApp....
Alex's user avatar
  • 21
0 votes
0 answers
33 views

How does Windows determine dll address when using loadlibrary

First, sorry for my bad english. I'm trying to make emulator to emulating PE binary with unicorn emulator. My goal is place every dll in emulator that PE needed and hook some specific APIs. What I am ...
schnabel's user avatar
0 votes
1 answer
129 views

Hooking a function

So, I'm attempting to create a mod for an older game, Fable: The Lost Chapters. I was able to find the MacOS release of the game, which contains symbols, and I was also able to find a leaked debug ...
Reaper's user avatar
  • 1
0 votes
0 answers
48 views

IDA can't load DLL, possibly packed but how?

I tried to load a DLL to reverse engineer the code inside using IDA, but it tells me this on loading: So i assume the .text resource is somewhat "packed". I then fetched a tool named "...
HeckMeck's user avatar
0 votes
1 answer
84 views

How to call unexported function in a third party DLL while having its PDB?

I'm new to reverse engineering and recently met with a problem: I have the dll and pdb of a debug version third party module, but I don't have its source codes. Now I want to write a piece of C++ code ...
Nekomiya Kasane's user avatar
3 votes
0 answers
139 views

Reverse DLL and EXE at the same time?

I started reversing a 32-bit x86 EXE that led me down the path of finding the structure and core functions I needed inside of a DLL. I'm currently using Binary Ninja 3.5 as my disassembler, decompiler,...
TyCobb's user avatar
  • 131
0 votes
0 answers
131 views

Debug the DLL of an EXE using IDA Freeware

I'm trying to debug a DLL that is called in an executable file. I put the DLL in Ida Free and defined the breakpoints, and set 'Application' to the executable path. When I start the debug, the ...
Luiz's user avatar
  • 1
0 votes
0 answers
16 views

System.ComponentModel.LicenseException: 'Not correct assembly name.' error

I'm trying to decompile a dll using dnspy and changing the method names to my own name. The dll compiles sucessfully, but i get this error when i call any method - System.ComponentModel....
user44929's user avatar
2 votes
1 answer
481 views

How to find the correct GUID in DLL to match its Pdb

From this question: Is it possible to download program database (PDB) files of Microsoft Windows binaries without installing any software? and the answer from @chentiangemalc: You can also look for ...
Min Huang's user avatar
1 vote
0 answers
33 views

Anyway to hook to change file content and return for application keep read it?

is there anyway to modify v2 before statement if(v2) happen?
user3082026's user avatar
3 votes
0 answers
78 views

How to unpack emotet with x64dbg and do dynamic analysis?

I am a beginner at malware analysis. I have been trying to analyze Emotet using X64DBG. I followed the steps below and succeeded once, but when I repeated the same steps, I failed. Can you tell me if ...
KOT's user avatar
  • 31
2 votes
0 answers
329 views

What could be the reason-s for a exe not to load after a Dnspy modification to a DLL

After modifying a method of a DLL with Dnspy, the related EXE won't start. What could be the reason for it not starting? Here's what I did: I modified a method from a DLL with Dnspy using edit Method ...
Lod's user avatar
  • 121
2 votes
1 answer
500 views

Use 3rd-party DLL in my own application

Sorry if this is a bit long; I figured it might be helpful to provide some information on why I'm trying to do what I'm doing. If not, just skip to the "My Problem" section. Background I'm ...
Chris's user avatar
  • 31
3 votes
1 answer
334 views

Load PDB for MemoryModule-loaded DLL in x64dbg

I need to debug a DLL, which I have a PDB file for. The debug target is a program, that loads the DLL using MemoryModule library from Github. The loaded module isn't listed as a module in x64dbg, ...
Ri0ee's user avatar
  • 43
3 votes
0 answers
469 views

How to force IDA to load MFC DLL symbols while disassembling an EXE that uses such DLL?

I found that IDA may not load symbols for MFC DLLs while disassembling EXEs that load such DLLs. This makes the disassembling horrible if the DLL is linked just by ordinals, and IDA doesn't have a ...
Eugene Muzychenko's user avatar
3 votes
0 answers
249 views

PEStudio DLL analysis: flag in export section

I start to use PEStudio for DLL analysis; I understand (more or less) everything, except the "exports (flag)" section: What does it mean the X in the flag column? So, what is a/the flag? ...
Gianluca's user avatar
  • 131
2 votes
0 answers
88 views

Decoding CalibrationL6.dll

I am having problems with a dll, it is called CalibrationL6.dll, I have been able to see the code inside, and the function that interests me is this: public static int CalculateCoefficients( ...
raulelerma's user avatar
2 votes
2 answers
2k views

turning decompiled C++ code into writable C++

Here's my scenario I currently have a DLL that was made in like 2003 archived that has data and functions I still need to use and I'm also 90% sure the DLL doesn't work correctly as its too outdated. (...
DB_Coding's user avatar
2 votes
1 answer
72 views

generate code execution/cpu time flame-graph of library DLL (Noob question)

I have a library DLL which I'm trying to analyze, and I have a basic understanding of its function and behavior (and can modify some input to affect how long certain operations will take to execute/...
Matthew Gomes's user avatar
2 votes
0 answers
67 views

Can't view instructions inside the dll main function

I have a dll that is loaded by the program i'm reverse engineering, this dll only contains .text section without any exported functions, my guess is that dll main function contains something ...
asdfs99's user avatar
  • 41
4 votes
0 answers
223 views

Are system dlls like NTDLL and KERNELBASE etc. are always loaded at the same address on a per-session basis?

If I am understanding, code and read only sections of common DLLs are given system-wide section objects for which each process gets its own section view, in order to save physical memory. As such even ...
EatingTechnobladesRemainsAt3am's user avatar
1 vote
0 answers
282 views

radare2: How to load a DLL along with the application?

I am reverse engineering a Windows application for which there is no PDB file available. When loading it in r2, I get the following imports (They are correct): nth vaddr bind type lib ...
movzxb's user avatar
  • 11
0 votes
1 answer
156 views

Crackme assistance - unknown function [closed]

i have a problem about a crackme that my friend sent me for a bet. I solved most of it but i am stuck with this function. I can't even understand what the function is trying to do. Please help. images ...
dxAhax's user avatar
  • 1
3 votes
1 answer
447 views

Compress Xamarin assemblies after decompression

I have an APK that has assemblies in a single blob file. I could extract them successfully using decompress-assemblies. Is there anyway I can compress them again into assemblies.blob file or at least ...
paddle.code's user avatar
1 vote
1 answer
101 views

Calling a function with a variable number of args from a proxy DLL

The program I'm messing with has builtin logging. Using a proxy DLL, I managed to activate it by calling the right functions from the real DLL. However, I got stuck at using the actual logging ...
mindoverflow's user avatar
1 vote
0 answers
156 views

How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime

In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
Curious User's user avatar
1 vote
1 answer
658 views

Exporting dll out of a process memory

Idk if this is asked before sorry So I tried something with Process Hacker and Windbg but it couldn't help me The dll is injected using CreateRemoteThread, LoadLibrary i tried looking through files ...
Kreapet's user avatar
  • 13
0 votes
1 answer
125 views

How to detect incorrectly named DLL?

I am trying a simple lab on malware analysis and we were given both an .exe and .dll file. However, I am told that the DLL will need to be renamed to something for it to work. How do I go about ...
Iva l's user avatar
  • 1
2 votes
0 answers
187 views

Call function from dll

I am writing a program and I have injected "mydll" file into the program, but I cannot call the hello function in it. How can I call the hello function? My code: import os from ctypes import ...
Furkan125's user avatar
0 votes
1 answer
718 views

Best way to monitor the access to a DLL of a software?

I'm currently analyzing a complex software which compiles a kind of code. By monitoring and correlating it with ProcMon I could figure out it loads a DLL as a module. Now I'm trying to find out how ...
programmerskitchen's user avatar
1 vote
1 answer
834 views

Find DllMain using IDA Freeware

I want to use the IDA Freeware Version 7.7 for finding the DllMain of a DLL file. The file is from the book Practical Malware Analysis. It is for Lab 05. Name of file is "Lab05-01.dll" and ...
Hayeri's user avatar
  • 38
1 vote
1 answer
75 views

funcion calls extern function without body

I wanted to look at how does the Windows API get the size of a file, so I opened kernel32.dll in a disassembler. I searched for GetFileSizeEx, and it seems to call a stub(?), but the disassembler ...
geo10's user avatar
  • 145
2 votes
1 answer
517 views

How to hook to a system function

How to hook to external library function, such as OpenGL for example. I have a function used by the program I am trying to change behaviour of. The function is: lVar17 = glfwCreateWindow(uVar22,uVar25,...
Irbis77's user avatar
  • 328
1 vote
0 answers
120 views

Custom Chromium build - find registered extension's JS code

I have a custom chromium browser build which has a bunch of "native" functions which I would like to have definitions for. Apparently, these are registered as en extension using this ...
Seminko's user avatar
  • 11
0 votes
2 answers
353 views

How to declare a constructor in reversed class?

I wonder how to declare the reference to a constructor to a reversed class, i.e. I have a class say Game and it has a constructor at a certain address. It is declared like this: game.h namespace ...
Irbis77's user avatar
  • 328
0 votes
0 answers
107 views

Starting out with reverse engineering. What assembly is disassembled code

I am new to reverse engineering and want to analyze my own exe/dll files. I took a look at nasm and masm and so far I have the feeling that this is unnecessary for me to learn in detail because it ...
Nur1's user avatar
  • 101
1 vote
1 answer
1k views

How to step into an invoked method from a DotNet DLL in dnSpy?

I've been analyzing a malware written in C# using dnSpy. It loaded a dotnet assembly DLL from its Resources: I tried stepping into InvokeMember function, but could not go further when hitting this ...
gergeerew's user avatar
0 votes
1 answer
415 views

Proxy dll doesn't load the original dll

I have relatively simple code here for the proxy DllMain() function: BOOL APIENTRY DllMain(HMODULE hDll, DWORD reason, LPVOID reserved) { if (reason != DLL_PROCESS_ATTACH) { return TRUE; } ...
Irbis77's user avatar
  • 328
1 vote
1 answer
55 views

What's the meaning of @ tag on proxy dll?

In proxy dll in .def file I can see the following notation: _CreateFrameInfo=PROXY__CreateFrameInfo @1 Others use in the following format: _AIL_3D_position@16 = vcruntime140_._AIL_3D_position@16 ...
Irbis77's user avatar
  • 328
0 votes
0 answers
3k views

How to disassemble an obfuscated .NET DLL?

I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL: Any idea how to unpack it?
c00000fd's user avatar
  • 1,711
2 votes
0 answers
126 views

The method of searching for similar code in a binary file of a new release

Got into the hands of such a task. There are two dlls. As the second file was explained to me (new.dll) this is a new release of the first file (old.dll). Both files are compiled for x64. I need to ...
mlr's user avatar
  • 21
1 vote
0 answers
254 views

Why rundll32.exe could be loading a DLL multiple times?

Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason. Most of the time I use ...
hariseldon's user avatar
2 votes
1 answer
1k views

How to mark data as pointer to external functions in ghidra

I'm examining a piece of malware with Ghidra, and like most malware it uses LoadLibrary and GetProcAddress to dynamically load libraries and functions. GetProcAddress stores the function addresses in ...
Petrarch's user avatar
7 votes
1 answer
3k views

Why can C# applications be reverse-compiled with variable names while C++ ones can't?

Why can programs written in C# be reverse-compiled essentially to their original form with variables names (such as dnSpy) while C++ decompilers (such as Ghidra) are unable to decode the variable ...
Polydynamical's user avatar
1 vote
0 answers
334 views

How to retrieve the encryption key from a dll file?

I have a dll file that makes an http post request to a webserver , request looks something like this : UmdUsFrEB3wGMuuAz1Znywuedx6+...
Sanders's user avatar
  • 11
1 vote
0 answers
349 views

Editing assembly language to bypass the condition

I want to edit the compiled DLL code to bypass the variable checking condition. I tried to change the value in the condition but it causes an application crash. How can I "remove" this ...
FileEX's user avatar
  • 11
0 votes
1 answer
114 views

FINDING & EXECUTING a function from an exe/dll (not compiled by me)?

my Problem is, i have bought a Huion Kamvas 22 Plus pen display for drawing and painting. On my old Wacom tablet i had some hardware buttons and could map functions/setting of the driver to these ...
Alexander Mehler's user avatar
0 votes
1 answer
544 views

open decompiler view of current module (dll) in dynamic analysis

I have a program (P.exe) with several dependencies (A.dll, B.dll etc). I decompiled and studied B.dll, but at runtime, P.exe is using A.dll. The horizon is updating in ISA view-RIP, but I don't have ...
Soleil's user avatar
  • 123
2 votes
1 answer
2k views

How do I execute "File -> Add To Program..." in a Ghidra script?

I'm reversing an old video game with large number of shared libraries, and in order to reference them all correctly (via "thunk" functions?) I think I need to import all of the raw files ...
Trevor Glauz's user avatar

1
2 3 4 5