Questions tagged [dll]
Dynamic-link library, or DLL, is Microsoft's implementation of the shared library concept in the Microsoft Windows and OS/2 operating systems.
211
questions
0
votes
0
answers
61
views
Debug the DLL of an EXE using IDA Freeware
I'm trying to debug a DLL that is called in an executable file. I put the DLL in Ida Free and defined the breakpoints, and set 'Application' to the executable path. When I start the debug, the ...
- 1
0
votes
0
answers
12
views
System.ComponentModel.LicenseException: 'Not correct assembly name.' error
I'm trying to decompile a dll using dnspy and changing the method names to my own name. The dll compiles sucessfully, but i get this error when i call any method - System.ComponentModel....
2
votes
1
answer
187
views
How to find the correct GUID in DLL to match its Pdb
From this question: Is it possible to download program database (PDB) files of Microsoft Windows binaries without installing any software?
and the answer from @chentiangemalc:
You can also look for ...
- 21
1
vote
0
answers
31
views
Anyway to hook to change file content and return for application keep read it?
is there anyway to modify v2 before statement if(v2) happen?
- 11
3
votes
0
answers
60
views
How to unpack emotet with x64dbg and do dynamic analysis?
I am a beginner at malware analysis. I have been trying to analyze Emotet using X64DBG. I followed the steps below and succeeded once, but when I repeated the same steps, I failed. Can you tell me if ...
- 31
2
votes
0
answers
172
views
What could be the reason-s for a exe not to load after a Dnspy modification to a DLL
After modifying a method of a DLL with Dnspy, the related EXE won't start.
What could be the reason for it not starting?
Here's what I did:
I modified a method from a DLL with Dnspy using edit Method ...
- 121
2
votes
1
answer
197
views
Use 3rd-party DLL in my own application
Sorry if this is a bit long; I figured it might be helpful to provide some information on why I'm trying to do what I'm doing. If not, just skip to the "My Problem" section.
Background
I'm ...
- 31
3
votes
1
answer
191
views
Load PDB for MemoryModule-loaded DLL in x64dbg
I need to debug a DLL, which I have a PDB file for.
The debug target is a program, that loads the DLL using MemoryModule library from Github.
The loaded module isn't listed as a module in x64dbg, ...
- 43
3
votes
0
answers
248
views
How to force IDA to load MFC DLL symbols while disassembling an EXE that uses such DLL?
I found that IDA may not load symbols for MFC DLLs while disassembling EXEs that load such DLLs. This makes the disassembling horrible if the DLL is linked just by ordinals, and IDA doesn't have a ...
3
votes
0
answers
145
views
PEStudio DLL analysis: flag in export section
I start to use PEStudio for DLL analysis; I understand (more or less) everything, except the "exports (flag)" section:
What does it mean the X in the flag column? So, what is a/the flag?
...
- 131
2
votes
0
answers
61
views
Decoding CalibrationL6.dll
I am having problems with a dll, it is called CalibrationL6.dll, I have been able to see the code inside, and the function that interests me is this:
public static int CalculateCoefficients(
...
- 21
2
votes
2
answers
1k
views
turning decompiled C++ code into writable C++
Here's my scenario I currently have a DLL that was made in like 2003 archived that has data and functions I still need to use and I'm also 90% sure the DLL doesn't work correctly as its too outdated. (...
- 21
2
votes
1
answer
58
views
generate code execution/cpu time flame-graph of library DLL (Noob question)
I have a library DLL which I'm trying to analyze, and I have a basic understanding of its function and behavior (and can modify some input to affect how long certain operations will take to execute/...
2
votes
0
answers
64
views
Can't view instructions inside the dll main function
I have a dll that is loaded by the program i'm reverse engineering, this dll only contains .text section without any exported functions, my guess is that dll main function contains something ...
- 41
3
votes
0
answers
168
views
Are system dlls like NTDLL and KERNELBASE etc. are always loaded at the same address on a per-session basis?
If I am understanding, code and read only sections of common DLLs are given system-wide section objects for which each process gets its own section view, in order to save physical memory. As such even ...
1
vote
0
answers
200
views
radare2: How to load a DLL along with the application?
I am reverse engineering a Windows application for which there is no PDB file available.
When loading it in r2, I get the following imports (They are correct):
nth vaddr bind type lib ...
- 11
0
votes
1
answer
154
views
Crackme assistance - unknown function [closed]
i have a problem about a crackme that my friend sent me for a bet. I solved most of it but i am stuck with this function. I can't even understand what the function is trying to do. Please help.
images ...
- 1
3
votes
1
answer
279
views
Compress Xamarin assemblies after decompression
I have an APK that has assemblies in a single blob file. I could extract them successfully using decompress-assemblies.
Is there anyway I can compress them again into assemblies.blob file or at least ...
- 31
1
vote
1
answer
81
views
Calling a function with a variable number of args from a proxy DLL
The program I'm messing with has builtin logging. Using a proxy DLL, I managed to activate it by calling the right functions from the real DLL. However, I got stuck at using the actual logging ...
- 149
1
vote
0
answers
115
views
How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime
In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
- 11
1
vote
1
answer
514
views
Exporting dll out of a process memory
Idk if this is asked before sorry
So I tried something with Process Hacker and Windbg but it couldn't help me
The dll is injected using CreateRemoteThread, LoadLibrary i tried looking through files ...
- 13
0
votes
1
answer
98
views
How to detect incorrectly named DLL?
I am trying a simple lab on malware analysis and we were given both an .exe and .dll file.
However, I am told that the DLL will need to be renamed to something for it to work.
How do I go about ...
- 1
2
votes
0
answers
167
views
Call function from dll
I am writing a program and I have injected "mydll" file into the program, but I cannot call the hello function in it. How can I call the hello function? My code:
import os
from ctypes import ...
- 21
0
votes
1
answer
435
views
Best way to monitor the access to a DLL of a software?
I'm currently analyzing a complex software which compiles a kind of code. By monitoring and correlating it with ProcMon I could figure out it loads a DLL as a module.
Now I'm trying to find out how ...
1
vote
1
answer
680
views
Find DllMain using IDA Freeware
I want to use the IDA Freeware Version 7.7 for finding the DllMain of a DLL file. The file is from the book Practical Malware Analysis. It is for Lab 05. Name of file is "Lab05-01.dll" and ...
- 38
1
vote
1
answer
65
views
funcion calls extern function without body
I wanted to look at how does the Windows API get the size of a file, so I opened kernel32.dll in a disassembler. I searched for GetFileSizeEx, and it seems to call a stub(?), but the disassembler ...
- 145
2
votes
1
answer
480
views
How to hook to a system function
How to hook to external library function, such as OpenGL for example.
I have a function used by the program I am trying to change behaviour of. The function is:
lVar17 = glfwCreateWindow(uVar22,uVar25,...
- 326
1
vote
0
answers
118
views
Custom Chromium build - find registered extension's JS code
I have a custom chromium browser build which has a bunch of "native" functions which I would like to have definitions for.
Apparently, these are registered as en extension using this ...
- 11
0
votes
1
answer
260
views
How to declare a constructor in reversed class?
I wonder how to declare the reference to a constructor to a reversed class, i.e. I have a class say Game and it has a constructor at a certain address.
It is declared like this:
game.h
namespace ...
- 326
0
votes
0
answers
103
views
Starting out with reverse engineering. What assembly is disassembled code
I am new to reverse engineering and want to analyze my own exe/dll files. I took a look at nasm and masm and so far I have the feeling that this is unnecessary for me to learn in detail because it ...
- 101
1
vote
1
answer
754
views
How to step into an invoked method from a DotNet DLL in dnSpy?
I've been analyzing a malware written in C# using dnSpy. It loaded a dotnet assembly DLL from its Resources:
I tried stepping into InvokeMember function, but could not go further when hitting this ...
- 11
0
votes
1
answer
294
views
Proxy dll doesn't load the original dll
I have relatively simple code here for the proxy DllMain() function:
BOOL APIENTRY DllMain(HMODULE hDll, DWORD reason, LPVOID reserved)
{
if (reason != DLL_PROCESS_ATTACH) {
return TRUE;
}
...
- 326
1
vote
1
answer
54
views
What's the meaning of @ tag on proxy dll?
In proxy dll in .def file I can see the following notation:
_CreateFrameInfo=PROXY__CreateFrameInfo @1
Others use in the following format:
_AIL_3D_position@16 = vcruntime140_._AIL_3D_position@16
...
- 326
0
votes
0
answers
2k
views
How to disassemble an obfuscated .NET DLL?
I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL:
Any idea how to unpack it?
- 1,639
2
votes
0
answers
109
views
The method of searching for similar code in a binary file of a new release
Got into the hands of such a task. There are two dlls. As the second file was explained to me (new.dll) this is a new release of the first file (old.dll). Both files are compiled for x64. I need to ...
- 21
1
vote
0
answers
230
views
Why rundll32.exe could be loading a DLL multiple times?
Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason.
Most of the time I use ...
- 11
2
votes
1
answer
1k
views
How to mark data as pointer to external functions in ghidra
I'm examining a piece of malware with Ghidra, and like most malware it uses LoadLibrary and GetProcAddress to dynamically load libraries and functions. GetProcAddress stores the function addresses in ...
- 21
7
votes
1
answer
3k
views
Why can C# applications be reverse-compiled with variable names while C++ ones can't?
Why can programs written in C# be reverse-compiled essentially to their original form with variables names (such as dnSpy) while C++ decompilers (such as Ghidra) are unable to decode the variable ...
- 173
1
vote
0
answers
277
views
How to retrieve the encryption key from a dll file?
I have a dll file that makes an http post request to a webserver , request looks something like this :
UmdUsFrEB3wGMuuAz1Znywuedx6+...
- 11
1
vote
0
answers
286
views
Editing assembly language to bypass the condition
I want to edit the compiled DLL code to bypass the variable checking condition. I tried to change the value in the condition but it causes an application crash. How can I "remove" this ...
- 11
0
votes
1
answer
103
views
FINDING & EXECUTING a function from an exe/dll (not compiled by me)?
my Problem is, i have bought a Huion Kamvas 22 Plus pen display for drawing and painting.
On my old Wacom tablet i had some hardware buttons and could map functions/setting of the driver to these ...
0
votes
1
answer
436
views
open decompiler view of current module (dll) in dynamic analysis
I have a program (P.exe) with several dependencies (A.dll, B.dll etc). I decompiled and studied B.dll, but at runtime, P.exe is using A.dll. The horizon is updating in ISA view-RIP, but I don't have ...
- 123
2
votes
1
answer
1k
views
How do I execute "File -> Add To Program..." in a Ghidra script?
I'm reversing an old video game with large number of shared libraries, and in order to reference them all correctly (via "thunk" functions?) I think I need to import all of the raw files ...
- 21
1
vote
2
answers
268
views
Cannot disassemble exported functions
I want to disassemble a function from Kernel32.dll to see what it does, but every single function I try looks like this in the decompiler:
Function:
jmp ds:Function_0
Where is the function? ...
- 111
0
votes
0
answers
349
views
Adding an export entry into dll file
There is an dll file which i need to edit, Using PE Explorer option, Export Viewer i can see a long list of items and i suppose each entry is called "Export Function". Using notepad++ i can ...
- 1
3
votes
1
answer
1k
views
Rebuild IAT after manually unpacking DLL
I've been trying to unpack this dll and I'm pretty sure that 0x7c3ea902 or 0x1007A9D2 (ASLR disabled) or simply 0x7A9D2 is OEP.
But after dumping with OllyDumpEx and trying to fix IAT with ImpREC it ...
- 225
4
votes
1
answer
236
views
Statically recovering thunks in Windows x86_64 DLL
I just started working my way to reversing Windows binaries and I stumbled upon the Import Address Table. When reversing a particular DLL I encountered many thunk-functions which all supposedly ...
- 143
1
vote
1
answer
844
views
how can ı debug encrypted dll with x32dbg and look getregistery request
I have an executable with 2 .dll calls 1 of this dll is guard.dll others name is guardlib.dll both of them is encrypted c++ library file and they are called before executable entry point.
I can bypass ...
- 13
1
vote
1
answer
99
views
How do you recommend going for applying minor changes in an executable through a dll?
My choice of words in the title might be poor, I apologize: english is not my primary language and I have no idea how to word it better.
I have a game executable to which I applied several changes, ...
- 41
1
vote
1
answer
8k
views
Getting Ghidra project to recognize referenced DLL
I am reverse engineering a very old game and when I load up the executable in Ghidra, I see a handful of imported dlls
I do however not see one of the DLLs the game uses to wrap various client ...
