Questions tagged [dll]

Dynamic-link library, or DLL, is Microsoft's implementation of the shared library concept in the Microsoft Windows and OS/2 operating systems.

Filter by
Sorted by
Tagged with
0 votes
0 answers
61 views

Debug the DLL of an EXE using IDA Freeware

I'm trying to debug a DLL that is called in an executable file. I put the DLL in Ida Free and defined the breakpoints, and set 'Application' to the executable path. When I start the debug, the ...
Luiz's user avatar
  • 1
0 votes
0 answers
12 views

System.ComponentModel.LicenseException: 'Not correct assembly name.' error

I'm trying to decompile a dll using dnspy and changing the method names to my own name. The dll compiles sucessfully, but i get this error when i call any method - System.ComponentModel....
user44929's user avatar
2 votes
1 answer
187 views

How to find the correct GUID in DLL to match its Pdb

From this question: Is it possible to download program database (PDB) files of Microsoft Windows binaries without installing any software? and the answer from @chentiangemalc: You can also look for ...
Min Huang's user avatar
1 vote
0 answers
31 views

Anyway to hook to change file content and return for application keep read it?

is there anyway to modify v2 before statement if(v2) happen?
user3082026's user avatar
3 votes
0 answers
60 views

How to unpack emotet with x64dbg and do dynamic analysis?

I am a beginner at malware analysis. I have been trying to analyze Emotet using X64DBG. I followed the steps below and succeeded once, but when I repeated the same steps, I failed. Can you tell me if ...
KOT's user avatar
  • 31
2 votes
0 answers
172 views

What could be the reason-s for a exe not to load after a Dnspy modification to a DLL

After modifying a method of a DLL with Dnspy, the related EXE won't start. What could be the reason for it not starting? Here's what I did: I modified a method from a DLL with Dnspy using edit Method ...
Lod's user avatar
  • 121
2 votes
1 answer
197 views

Use 3rd-party DLL in my own application

Sorry if this is a bit long; I figured it might be helpful to provide some information on why I'm trying to do what I'm doing. If not, just skip to the "My Problem" section. Background I'm ...
Chris's user avatar
  • 31
3 votes
1 answer
191 views

Load PDB for MemoryModule-loaded DLL in x64dbg

I need to debug a DLL, which I have a PDB file for. The debug target is a program, that loads the DLL using MemoryModule library from Github. The loaded module isn't listed as a module in x64dbg, ...
Ri0ee's user avatar
  • 43
3 votes
0 answers
248 views

How to force IDA to load MFC DLL symbols while disassembling an EXE that uses such DLL?

I found that IDA may not load symbols for MFC DLLs while disassembling EXEs that load such DLLs. This makes the disassembling horrible if the DLL is linked just by ordinals, and IDA doesn't have a ...
Eugene Muzychenko's user avatar
3 votes
0 answers
145 views

PEStudio DLL analysis: flag in export section

I start to use PEStudio for DLL analysis; I understand (more or less) everything, except the "exports (flag)" section: What does it mean the X in the flag column? So, what is a/the flag? ...
Gianluca's user avatar
  • 131
2 votes
0 answers
61 views

Decoding CalibrationL6.dll

I am having problems with a dll, it is called CalibrationL6.dll, I have been able to see the code inside, and the function that interests me is this: public static int CalculateCoefficients( ...
raulelerma's user avatar
2 votes
2 answers
1k views

turning decompiled C++ code into writable C++

Here's my scenario I currently have a DLL that was made in like 2003 archived that has data and functions I still need to use and I'm also 90% sure the DLL doesn't work correctly as its too outdated. (...
DB_Coding's user avatar
2 votes
1 answer
58 views

generate code execution/cpu time flame-graph of library DLL (Noob question)

I have a library DLL which I'm trying to analyze, and I have a basic understanding of its function and behavior (and can modify some input to affect how long certain operations will take to execute/...
Matthew Gomes's user avatar
2 votes
0 answers
64 views

Can't view instructions inside the dll main function

I have a dll that is loaded by the program i'm reverse engineering, this dll only contains .text section without any exported functions, my guess is that dll main function contains something ...
asdfs99's user avatar
  • 41
3 votes
0 answers
168 views

Are system dlls like NTDLL and KERNELBASE etc. are always loaded at the same address on a per-session basis?

If I am understanding, code and read only sections of common DLLs are given system-wide section objects for which each process gets its own section view, in order to save physical memory. As such even ...
EatingTechnobladesRemainsAt3am's user avatar
1 vote
0 answers
200 views

radare2: How to load a DLL along with the application?

I am reverse engineering a Windows application for which there is no PDB file available. When loading it in r2, I get the following imports (They are correct): nth vaddr bind type lib ...
movzxb's user avatar
  • 11
0 votes
1 answer
154 views

Crackme assistance - unknown function [closed]

i have a problem about a crackme that my friend sent me for a bet. I solved most of it but i am stuck with this function. I can't even understand what the function is trying to do. Please help. images ...
dxAhax's user avatar
  • 1
3 votes
1 answer
279 views

Compress Xamarin assemblies after decompression

I have an APK that has assemblies in a single blob file. I could extract them successfully using decompress-assemblies. Is there anyway I can compress them again into assemblies.blob file or at least ...
paddle.code's user avatar
1 vote
1 answer
81 views

Calling a function with a variable number of args from a proxy DLL

The program I'm messing with has builtin logging. Using a proxy DLL, I managed to activate it by calling the right functions from the real DLL. However, I got stuck at using the actual logging ...
mindoverflow's user avatar
1 vote
0 answers
115 views

How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime

In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
Curious User's user avatar
1 vote
1 answer
514 views

Exporting dll out of a process memory

Idk if this is asked before sorry So I tried something with Process Hacker and Windbg but it couldn't help me The dll is injected using CreateRemoteThread, LoadLibrary i tried looking through files ...
Kreapet's user avatar
  • 13
0 votes
1 answer
98 views

How to detect incorrectly named DLL?

I am trying a simple lab on malware analysis and we were given both an .exe and .dll file. However, I am told that the DLL will need to be renamed to something for it to work. How do I go about ...
Iva l's user avatar
  • 1
2 votes
0 answers
167 views

Call function from dll

I am writing a program and I have injected "mydll" file into the program, but I cannot call the hello function in it. How can I call the hello function? My code: import os from ctypes import ...
Furkan125's user avatar
0 votes
1 answer
435 views

Best way to monitor the access to a DLL of a software?

I'm currently analyzing a complex software which compiles a kind of code. By monitoring and correlating it with ProcMon I could figure out it loads a DLL as a module. Now I'm trying to find out how ...
programmerskitchen's user avatar
1 vote
1 answer
680 views

Find DllMain using IDA Freeware

I want to use the IDA Freeware Version 7.7 for finding the DllMain of a DLL file. The file is from the book Practical Malware Analysis. It is for Lab 05. Name of file is "Lab05-01.dll" and ...
Hayeri's user avatar
  • 38
1 vote
1 answer
65 views

funcion calls extern function without body

I wanted to look at how does the Windows API get the size of a file, so I opened kernel32.dll in a disassembler. I searched for GetFileSizeEx, and it seems to call a stub(?), but the disassembler ...
geo10's user avatar
  • 145
2 votes
1 answer
480 views

How to hook to a system function

How to hook to external library function, such as OpenGL for example. I have a function used by the program I am trying to change behaviour of. The function is: lVar17 = glfwCreateWindow(uVar22,uVar25,...
Irbis77's user avatar
  • 326
1 vote
0 answers
118 views

Custom Chromium build - find registered extension's JS code

I have a custom chromium browser build which has a bunch of "native" functions which I would like to have definitions for. Apparently, these are registered as en extension using this ...
Seminko's user avatar
  • 11
0 votes
1 answer
260 views

How to declare a constructor in reversed class?

I wonder how to declare the reference to a constructor to a reversed class, i.e. I have a class say Game and it has a constructor at a certain address. It is declared like this: game.h namespace ...
Irbis77's user avatar
  • 326
0 votes
0 answers
103 views

Starting out with reverse engineering. What assembly is disassembled code

I am new to reverse engineering and want to analyze my own exe/dll files. I took a look at nasm and masm and so far I have the feeling that this is unnecessary for me to learn in detail because it ...
Nur1's user avatar
  • 101
1 vote
1 answer
754 views

How to step into an invoked method from a DotNet DLL in dnSpy?

I've been analyzing a malware written in C# using dnSpy. It loaded a dotnet assembly DLL from its Resources: I tried stepping into InvokeMember function, but could not go further when hitting this ...
gergeerew's user avatar
0 votes
1 answer
294 views

Proxy dll doesn't load the original dll

I have relatively simple code here for the proxy DllMain() function: BOOL APIENTRY DllMain(HMODULE hDll, DWORD reason, LPVOID reserved) { if (reason != DLL_PROCESS_ATTACH) { return TRUE; } ...
Irbis77's user avatar
  • 326
1 vote
1 answer
54 views

What's the meaning of @ tag on proxy dll?

In proxy dll in .def file I can see the following notation: _CreateFrameInfo=PROXY__CreateFrameInfo @1 Others use in the following format: _AIL_3D_position@16 = vcruntime140_._AIL_3D_position@16 ...
Irbis77's user avatar
  • 326
0 votes
0 answers
2k views

How to disassemble an obfuscated .NET DLL?

I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL: Any idea how to unpack it?
c00000fd's user avatar
  • 1,639
2 votes
0 answers
109 views

The method of searching for similar code in a binary file of a new release

Got into the hands of such a task. There are two dlls. As the second file was explained to me (new.dll) this is a new release of the first file (old.dll). Both files are compiled for x64. I need to ...
mlr's user avatar
  • 21
1 vote
0 answers
230 views

Why rundll32.exe could be loading a DLL multiple times?

Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason. Most of the time I use ...
hariseldon's user avatar
2 votes
1 answer
1k views

How to mark data as pointer to external functions in ghidra

I'm examining a piece of malware with Ghidra, and like most malware it uses LoadLibrary and GetProcAddress to dynamically load libraries and functions. GetProcAddress stores the function addresses in ...
Petrarch's user avatar
7 votes
1 answer
3k views

Why can C# applications be reverse-compiled with variable names while C++ ones can't?

Why can programs written in C# be reverse-compiled essentially to their original form with variables names (such as dnSpy) while C++ decompilers (such as Ghidra) are unable to decode the variable ...
Polydynamical's user avatar
1 vote
0 answers
277 views

How to retrieve the encryption key from a dll file?

I have a dll file that makes an http post request to a webserver , request looks something like this : UmdUsFrEB3wGMuuAz1Znywuedx6+...
Sanders's user avatar
  • 11
1 vote
0 answers
286 views

Editing assembly language to bypass the condition

I want to edit the compiled DLL code to bypass the variable checking condition. I tried to change the value in the condition but it causes an application crash. How can I "remove" this ...
FileEX's user avatar
  • 11
0 votes
1 answer
103 views

FINDING & EXECUTING a function from an exe/dll (not compiled by me)?

my Problem is, i have bought a Huion Kamvas 22 Plus pen display for drawing and painting. On my old Wacom tablet i had some hardware buttons and could map functions/setting of the driver to these ...
Alexander Mehler's user avatar
0 votes
1 answer
436 views

open decompiler view of current module (dll) in dynamic analysis

I have a program (P.exe) with several dependencies (A.dll, B.dll etc). I decompiled and studied B.dll, but at runtime, P.exe is using A.dll. The horizon is updating in ISA view-RIP, but I don't have ...
Soleil's user avatar
  • 123
2 votes
1 answer
1k views

How do I execute "File -> Add To Program..." in a Ghidra script?

I'm reversing an old video game with large number of shared libraries, and in order to reference them all correctly (via "thunk" functions?) I think I need to import all of the raw files ...
Trevor Glauz's user avatar
1 vote
2 answers
268 views

Cannot disassemble exported functions

I want to disassemble a function from Kernel32.dll to see what it does, but every single function I try looks like this in the decompiler: Function: jmp ds:Function_0 Where is the function? ...
Carol Victor's user avatar
0 votes
0 answers
349 views

Adding an export entry into dll file

There is an dll file which i need to edit, Using PE Explorer option, Export Viewer i can see a long list of items and i suppose each entry is called "Export Function". Using notepad++ i can ...
wekos's user avatar
  • 1
3 votes
1 answer
1k views

Rebuild IAT after manually unpacking DLL

I've been trying to unpack this dll and I'm pretty sure that 0x7c3ea902 or 0x1007A9D2 (ASLR disabled) or simply 0x7A9D2 is OEP. But after dumping with OllyDumpEx and trying to fix IAT with ImpREC it ...
majidarif's user avatar
  • 225
4 votes
1 answer
236 views

Statically recovering thunks in Windows x86_64 DLL

I just started working my way to reversing Windows binaries and I stumbled upon the Import Address Table. When reversing a particular DLL I encountered many thunk-functions which all supposedly ...
milck's user avatar
  • 143
1 vote
1 answer
844 views

how can ı debug encrypted dll with x32dbg and look getregistery request

I have an executable with 2 .dll calls 1 of this dll is guard.dll others name is guardlib.dll both of them is encrypted c++ library file and they are called before executable entry point. I can bypass ...
eray erkol's user avatar
1 vote
1 answer
99 views

How do you recommend going for applying minor changes in an executable through a dll?

My choice of words in the title might be poor, I apologize: english is not my primary language and I have no idea how to word it better. I have a game executable to which I applied several changes, ...
Fei T's user avatar
  • 41
1 vote
1 answer
8k views

Getting Ghidra project to recognize referenced DLL

I am reverse engineering a very old game and when I load up the executable in Ghidra, I see a handful of imported dlls I do however not see one of the DLLs the game uses to wrap various client ...
Johnson Ploobnis's user avatar

1
2 3 4 5