Questions tagged [dll]

Dynamic-link library, or DLL, is Microsoft's implementation of the shared library concept in the Microsoft Windows and OS/2 operating systems.

Filter by
Sorted by
Tagged with
1
vote
1answer
71 views

How do you recommend going for applying minor changes in an executable through a dll?

My choice of words in the title might be poor, I apologize: english is not my primary language and I have no idea how to word it better. I have a game executable to which I applied several changes, ...
0
votes
1answer
61 views

Getting Ghidra project to recognize referenced DLL

I am reverse engineering a very old game and when I load up the executable in Ghidra, I see a handful of imported dlls I do however not see one of the DLLs the game uses to wrap various client ...
0
votes
0answers
22 views

ILSpy edits wont save .dll

(I'm on mac btw) So I want to try game hacking, and I've done some research. So I made a simple unity first-person shooter and built it, and I went into the files and found Assembly-Csharp.dll and I ...
0
votes
0answers
24 views

x64dbg how to find name of DLL not found

I have a program that hangs at start on my Window 10 system but runs ok on a VM running a vanilla Windows 10 system. Using x64dbg I get to an error where it states a DLL is not found. I have been ...
0
votes
0answers
47 views

.NET - What kind of obfuscation is this?

I'm currently performing some malicious DLL malware analysis, and I'm having some issues figuring out how to de-obfuscate this particular sample. It uses a lot of Reflective Assembly calls, and, a lot ...
0
votes
0answers
40 views

Debug dll file used in python script IDA

I am fairly new to RE on windows. I have a python script which via ctypes uses functions from a dll. I don't know if it's possible, but I would like to debug the dll used in the python script (the dll ...
0
votes
0answers
29 views

Finding RAM value in IDA Pro

At line #9 of a function, I have a variable that points to a RAM Cell. Actually I have a WORD at address E1C4. I would like to know how can I get value of this variable? I find a location where used ...
0
votes
0answers
46 views

Can I reverse engineer a DLL file and add SEH or some error handing codes to it?

I am using some DLL files in my Java application using JNI library. The dlls are not written by me and I do not have access to their source codes. They are so buggy and throw lots of exceptions. ...
2
votes
0answers
60 views

Is there a way to view the complete “Additional Information” log of Ghidra's “Import Results Summary”?

I'm currently trying to look into Q.U.B.E. 2's internal mechanics, so I decided to look at it using Ghidra. Q.U.B.E. 2 is built upon UnrealEngine, so it it's pretty big (~50 Mb's). However, when ...
4
votes
1answer
103 views

what routine in ntdll.dll is responsible of dispatching DllMain function of loaded dll?

I'm trying to debug a dll file using Ida disassembler and Windbg. I'm debugging rundll32.exe and passing the target dll (debugee) as an argument. I'm able to have a breakpoint on each Dll load & ...
0
votes
0answers
47 views

Specifying DLL imports within the PE?

I have unpacked and dumped a dll that uses a custom IAT to resolve Win32 API calls (143 of them). Is there anyway to modify the dumped dll PE to include these imports dynamcially and forward their ...
1
vote
2answers
144 views

How to decompile “call eax” in IDA Pro?

I know that there is a similar question but the answers didn't provide any fix for that problem. I am decompiling a .dll file, and I have found out the subroutine that I needed, but it's throwing a "...
0
votes
1answer
50 views

Loading a PE32 executable DLL Intel 80386 into a c# program

I'm new here so I'm sorry if this isn't the right section for my question. I'm reverse engineering a software that's written in .net 3.5 c# which loads a weird dynamic dll, which has an important ...
2
votes
3answers
107 views

How does an application identify a DLL file

Sorry if this is a basic question, as I'm very new at this. I'm trying to get an .exe to load a dummy .dll. I've created an example .dll project in VC++ 2019, added the functions listed in the .exe's ...
0
votes
0answers
23 views

How to visualize execution paths of dll in IDA pro

I'd like to know how to visualize execution paths of dll in IDA pro. I've used lighthouse with drcov to colorize the paths of exe, but I can't do it for dll. It's no problems for me if a way to ...
1
vote
2answers
58 views

Access DLL PE file by PEB dllbase address

I got the dllbase address from PEB InMemoryOrderModuleListItem list and I am trying to access the PE dos header file of a DLL. I am new to reverse engineering and in the past, I accessed the dos ...
0
votes
0answers
44 views

Develop a Hello World plugin for Ollydbg

I wanted to write a plugin for Ollydbg 2 which shows just a simple message. I write the following one but it doesn't load in ollydbg. I am using ollydbg 2 and my DLL can't load by it. Where is the ...
0
votes
1answer
182 views

c++ reading process memory with injected DLL

The reading works fine until it reaches base+27.058.176(bytes) address. At this address VirtualProtect() failes with error 487 (Attempt to access invalid address). Why does it return this error? Btw ...
0
votes
0answers
43 views

rep movsd for uninitialized data

I have this chunk of code in the DllMain() that I am failing to parse: sub_405644 proc near push ecx ; Save 4 registers push ...
0
votes
0answers
69 views

Cheat engine process causes game to crash

When I start cheat engine while game is running, the game crashes nearly immediately with error: "Exe does not work anymore." To figure out which checks the game does on processes I created a fake ...
2
votes
2answers
98 views

Function Prologue, add esp directive

I need to see how a DLL was written and I am using a x32dbg to do it at run-time. I am a newbie to this reversing stuff, so I am confused with this piece of code: push ebp ;...
2
votes
1answer
497 views

Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API

I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI. I thought it would be a simple registry key being modified so I used RegShot to ...
0
votes
0answers
44 views

How to call strongly encrypted DLL from Resources?

There is a program. This program accepts plugins. Plugins written with C#. I have to encrypt it. But when I use strong obfuscators I have exception. Program doesn't read. How can I fix that ? How can ...
0
votes
1answer
233 views

Attach one debugger to a DotNet application, and a second one to a loaded DLL

I'm trying to reverse an application that is using a DLL that i'm interested in. I can properly disassemble the application itself with DnSpy, as it is a .Net application, and I can disassemble the ...
0
votes
1answer
390 views

Ghidra can't Decompile kernelbase.dll exported functions?

I was trying to understand the IsDebuggerPresent() function exported by kernelbase.dll by importing the file on Ghidra. But Ghidra can't show me the proper disassembly or decompilation of function ...
0
votes
0answers
131 views

reverse engineering obfuscated .net dll

I am decompiling a third party .NET dll which was obfuscated using codeveil my aim is to get full source code, I tried decompiling using dnSpy, JustDecompile & Reflector however it just shows the ...
1
vote
1answer
178 views

mfc140 dll , what is the usage?

While I open exe file in ida I can see lot of calls to mfc140_6153 or mfc140_8718. What are those functions ? what they do ? thanks
0
votes
0answers
203 views

X32DBG ignores dependent DLL

I have EXE file which calls one specific DLL among other system DLLs. When I change a string value in this specific DLL I can see the changes when I execute the EXE file. For example I can change text ...
1
vote
2answers
1k views

How to debug a DLL written in .NET/C#?

I want to reverse engineer an application written in C#. I would like to set a breakpoint at a function and observe the input passed to it during the normal course of the application's functioning.
2
votes
1answer
288 views

Start vs WinMain()

I am trying to analyze a malicious DLL and when I loaded it in IDA, I can see two functions - DLLEntryPoint and DLLMain. I then proceeded to change the format by switching the characteristics bit that ...
1
vote
1answer
208 views

DLL obfuscator - what kind of obfuscator is this?

when I am looking for packet editor, I found open project on http://www.packeteditor.com/ when I learn how it works, I see that the application is injecting a dll named WSPE.dat, when I load this WSPE....
0
votes
1answer
68 views

Exported DLL function has only stdcall with some offset

I am quite new to reverse engineering. I have opened .dll (x86) in IDA Pro and I have noticed few exported functions. The issue is that all of them looks like this: IDA pseudocode: int __stdcall ...
1
vote
3answers
6k views

Unity game: Assembly dll embedded inside the exe

I'm trying to reverse engineer a game made with the Unity engine, and usually all of the games's scripts are in the files \<Game>_Data\Managed\Assembly-CSharp.dll and \<Game>_Data\Managed\...
1
vote
0answers
507 views

Understand DLL function signature from ordinal

I'm trying with ghidra to reverse a 32-bit proprietary application that uses mfc42.dll and I'm obtaining mixed results with respect to imported functions. To my surprise the DLLs don't use names to ...
2
votes
2answers
597 views

Permanently load a DLL to an executable

With the help of IDA I was able to hard-code changes into an executable by simply replacing some bytes with a hex editor, what I did was to change the resolution to something larger. I've learnt that ...
0
votes
1answer
456 views

Calling imported DLL functions from an injected DLL?

If I have injected my own DLL into an executable (a game specifically) which imports a DLL to draw its graphics, camera, etc. How can I go about calling the DLLs functions? I'm able to find the ...
1
vote
0answers
559 views

Dump packed dll

I am trying to analyze lua functions of game but dll is packed and I can't see them. I tried to dump dll with scylla https://github.com/NtQuery/Scylla but I still didn't get lua functions. Can someone ...
1
vote
1answer
90 views

When can trapping be used?

This is the beginning of one of the functions inside NTDLL of Windows XP: MOV EDI,EDI PUSH EBP MOV EBP,ESP ... The book on reverse engineering I am reading(Eldad Eilam - Reversing: Secrets of ...
2
votes
1answer
1k views

What is the difference between kernelBase.dll and Kernel32.dll

What is the difference between kernelBase.dll and Kernel32.dll in system32 folder ? Why both of them implement WideCharToMultiByte ?
4
votes
3answers
2k views

Get interface definition of undocumented COM objects

I have started exploring COM objects, initially I got to it from UAC bypass methods but I guess my question is general. The general question is: How can I get from (elevated) CLSID in the registry to ...
12
votes
2answers
3k views

What kind of code would produce this assemby with loads of jump statements?

00EE16CC . E9 DFBB0000 JMP BinFile.00EED2B0 00EE16D1 . E9 64AF0000 JMP <JMP.&MSVCP140D.?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@> 00EE16D6 . E9 15DB0000 JMP BinFile....
3
votes
2answers
1k views

Syscall from ntdll.dll

I am begginer in RE and also in Win NT world. I used IDA to disassemble ntdll.dll from Win XP SP 3. I care about non oficially documented function NtCreatePort which creates LPC port. I would find out ...
1
vote
1answer
405 views

VirtualProtect failed to revert protections on mrdata section of ntdll, why?

i perform a loop in assembly where i am parsing the sections of ntdll change their memory permissions with VirtualProtect and then revert them back to their original permissions. the code looks like ...
0
votes
2answers
91 views

How are images found inside DLLs accessed? [closed]

Sometimes a program displays images that don't exist as jpegs or bmps that come with the program so they have to be residing inside the exe itself or inside a DLL that comes with the program. So My ...
1
vote
1answer
411 views

What is ObjectStublessClientXX in ole32dll?

When I do dynamic reversing I saw usage with ObjectStublessClientXX in ole32.dll . What is that function? What does it do? Is there any way that it supposed to transfer message between 2 processes? ...
1
vote
2answers
4k views

Comparison between orginal and modified DLL files with x64dbg

Is it possible to find the modifications between a original DLL file and a modified one using x64dbg? And, if I can't do it with x64dbg, what tool would be better than a debugger to find the ...
1
vote
1answer
1k views

Outputting a patched DLL from x64dbg

I've been working on reversing an extremely outdated piece of software that I happen to need in order to get at the information stored in some equally outdated "database" files. Using x64dbg, I've ...
2
votes
2answers
243 views

Is there a good place to search information about known DLLs?

I'm just starting in learning some Reverse Engineering and there are a lot of DLLs being imported or called at runtime and I'd like to know what they do. I would have expected that there would be ...
5
votes
2answers
3k views

How can I access an internal DLL function or piece of data externally?

I'm writing in C++ and doing an exercise to familiarize myself with DLLs and shared objects (.so). How can I access internals without exporting them? GetProcAddress returns null on a call of an ...
0
votes
1answer
189 views

Help Needed reversing a function inside a DLL [closed]

I have a broken installation of Metalogix Archive Manager (MAM). Sometimes, I need to go and retrieve attachments that this has archived when it was previously working. The original attachment name ...