Questions tagged [dll]
Dynamic-link library, or DLL, is Microsoft's implementation of the shared library concept in the Microsoft Windows and OS/2 operating systems.
201
questions
1
vote
0
answers
39
views
Decoding CalibrationL6.dll
I am having problems with a dll, it is called CalibrationL6.dll, I have been able to see the code inside, and the function that interests me is this:
public static int CalculateCoefficients(
...
- 11
0
votes
2
answers
172
views
turning decompiled C++ code into writable C++
Here's my scenario I currently have a DLL that was made in like 2003 archived that has data and functions I still need to use and I'm also 90% sure the DLL doesn't work correctly as its too outdated. (...
2
votes
1
answer
35
views
generate code execution/cpu time flame-graph of library DLL (Noob question)
I have a library DLL which I'm trying to analyze, and I have a basic understanding of its function and behavior (and can modify some input to affect how long certain operations will take to execute/...
1
vote
0
answers
57
views
Can't view instructions inside the dll main function
I have a dll that is loaded by the program i'm reverse engineering, this dll only contains .text section without any exported functions, my guess is that dll main function contains something ...
- 21
2
votes
0
answers
84
views
Are system dlls like NTDLL and KERNELBASE etc. are always loaded at the same address on a per-session basis?
If I am understanding, code and read only sections of common DLLs are given system-wide section objects for which each process gets its own section view, in order to save physical memory. As such even ...
0
votes
0
answers
88
views
radare2: How to load a DLL along with the application?
I am reverse engineering a Windows application for which there is no PDB file available.
When loading it in r2, I get the following imports (They are correct):
nth vaddr bind type lib ...
- 1
0
votes
1
answer
144
views
Crackme assistance - unknown function [closed]
i have a problem about a crackme that my friend sent me for a bet. I solved most of it but i am stuck with this function. I can't even understand what the function is trying to do. Please help.
images ...
- 1
1
vote
0
answers
128
views
Compress Xamarin assemblies after decompression
I have an APK that has assemblies in a single blob file. I could extract them successfully using decompress-assemblies.
Is there anyway I can compress them again into assemblies.blob file or at least ...
- 11
1
vote
1
answer
41
views
Calling a function with a variable number of args from a proxy DLL
The program I'm messing with has builtin logging. Using a proxy DLL, I managed to activate it by calling the right functions from the real DLL. However, I got stuck at using the actual logging ...
- 149
1
vote
0
answers
62
views
How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime
In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
- 11
1
vote
1
answer
287
views
Exporting dll out of a process memory
Idk if this is asked before sorry
So I tried something with Process Hacker and Windbg but it couldn't help me
The dll is injected using CreateRemoteThread, LoadLibrary i tried looking through files ...
- 13
0
votes
1
answer
68
views
How to detect incorrectly named DLL?
I am trying a simple lab on malware analysis and we were given both an .exe and .dll file.
However, I am told that the DLL will need to be renamed to something for it to work.
How do I go about ...
- 1
1
vote
0
answers
111
views
Call function from dll
I am writing a program and I have injected "mydll" file into the program, but I cannot call the hello function in it. How can I call the hello function? My code:
import os
from ctypes import ...
- 11
0
votes
1
answer
195
views
Best way to monitor the access to a DLL of a software?
I'm currently analyzing a complex software which compiles a kind of code. By monitoring and correlating it with ProcMon I could figure out it loads a DLL as a module.
Now I'm trying to find out how ...
1
vote
1
answer
393
views
Find DllMain using IDA Freeware
I want to use the IDA Freeware Version 7.7 for finding the DllMain of a DLL file. The file is from the book Practical Malware Analysis. It is for Lab 05. Name of file is "Lab05-01.dll" and ...
- 38
1
vote
1
answer
60
views
funcion calls extern function without body
I wanted to look at how does the Windows API get the size of a file, so I opened kernel32.dll in a disassembler. I searched for GetFileSizeEx, and it seems to call a stub(?), but the disassembler ...
- 145
2
votes
1
answer
427
views
How to hook to a system function
How to hook to external library function, such as OpenGL for example.
I have a function used by the program I am trying to change behaviour of. The function is:
lVar17 = glfwCreateWindow(uVar22,uVar25,...
- 196
1
vote
0
answers
114
views
Custom Chromium build - find registered extension's JS code
I have a custom chromium browser build which has a bunch of "native" functions which I would like to have definitions for.
Apparently, these are registered as en extension using this ...
- 11
0
votes
1
answer
171
views
How to declare a constructor in reversed class?
I wonder how to declare the reference to a constructor to a reversed class, i.e. I have a class say Game and it has a constructor at a certain address.
It is declared like this:
game.h
namespace ...
- 196
0
votes
0
answers
97
views
Starting out with reverse engineering. What assembly is disassembled code
I am new to reverse engineering and want to analyze my own exe/dll files. I took a look at nasm and masm and so far I have the feeling that this is unnecessary for me to learn in detail because it ...
- 101
1
vote
1
answer
435
views
How to step into an invoked method from a DotNet DLL in dnSpy?
I've been analyzing a malware written in C# using dnSpy. It loaded a dotnet assembly DLL from its Resources:
I tried stepping into InvokeMember function, but could not go further when hitting this ...
- 11
0
votes
1
answer
212
views
Proxy dll doesn't load the original dll
I have relatively simple code here for the proxy DllMain() function:
BOOL APIENTRY DllMain(HMODULE hDll, DWORD reason, LPVOID reserved)
{
if (reason != DLL_PROCESS_ATTACH) {
return TRUE;
}
...
- 196
1
vote
1
answer
53
views
What's the meaning of @ tag on proxy dll?
In proxy dll in .def file I can see the following notation:
_CreateFrameInfo=PROXY__CreateFrameInfo @1
Others use in the following format:
_AIL_3D_position@16 = vcruntime140_._AIL_3D_position@16
...
- 196
0
votes
0
answers
1k
views
How to disassemble an obfuscated .NET DLL?
I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL:
Any idea how to unpack it?
- 1,437
1
vote
0
answers
77
views
The method of searching for similar code in a binary file of a new release
Got into the hands of such a task. There are two dlls. As the second file was explained to me (new.dll) this is a new release of the first file (old.dll). Both files are compiled for x64. I need to ...
- 11
0
votes
0
answers
186
views
Why rundll32.exe could be loading a DLL multiple times?
Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason.
Most of the time I use ...
2
votes
1
answer
702
views
How to mark data as pointer to external functions in ghidra
I'm examining a piece of malware with Ghidra, and like most malware it uses LoadLibrary and GetProcAddress to dynamically load libraries and functions. GetProcAddress stores the function addresses in ...
- 21
6
votes
1
answer
3k
views
Why can C# applications be reverse-compiled with variable names while C++ ones can't?
Why can programs written in C# be reverse-compiled essentially to their original form with variables names (such as dnSpy) while C++ decompilers (such as Ghidra) are unable to decode the variable ...
- 163
1
vote
0
answers
180
views
How to retrieve the encryption key from a dll file?
I have a dll file that makes an http post request to a webserver , request looks something like this :
UmdUsFrEB3wGMuuAz1Znywuedx6+...
- 11
0
votes
0
answers
178
views
Editing assembly language to bypass the condition
I want to edit the compiled DLL code to bypass the variable checking condition. I tried to change the value in the condition but it causes an application crash. How can I "remove" this ...
- 1
0
votes
1
answer
92
views
FINDING & EXECUTING a function from an exe/dll (not compiled by me)?
my Problem is, i have bought a Huion Kamvas 22 Plus pen display for drawing and painting.
On my old Wacom tablet i had some hardware buttons and could map functions/setting of the driver to these ...
0
votes
1
answer
262
views
open decompiler view of current module (dll) in dynamic analysis
I have a program (P.exe) with several dependencies (A.dll, B.dll etc). I decompiled and studied B.dll, but at runtime, P.exe is using A.dll. The horizon is updating in ISA view-RIP, but I don't have ...
- 123
2
votes
1
answer
955
views
How do I execute "File -> Add To Program..." in a Ghidra script?
I'm reversing an old video game with large number of shared libraries, and in order to reference them all correctly (via "thunk" functions?) I think I need to import all of the raw files ...
- 21
1
vote
2
answers
196
views
Cannot disassemble exported functions
I want to disassemble a function from Kernel32.dll to see what it does, but every single function I try looks like this in the decompiler:
Function:
jmp ds:Function_0
Where is the function? ...
- 111
0
votes
0
answers
255
views
Adding an export entry into dll file
There is an dll file which i need to edit, Using PE Explorer option, Export Viewer i can see a long list of items and i suppose each entry is called "Export Function". Using notepad++ i can ...
- 1
3
votes
1
answer
1k
views
Rebuild IAT after manually unpacking DLL
I've been trying to unpack this dll and I'm pretty sure that 0x7c3ea902 or 0x1007A9D2 (ASLR disabled) or simply 0x7A9D2 is OEP.
But after dumping with OllyDumpEx and trying to fix IAT with ImpREC it ...
- 215
4
votes
1
answer
189
views
Statically recovering thunks in Windows x86_64 DLL
I just started working my way to reversing Windows binaries and I stumbled upon the Import Address Table. When reversing a particular DLL I encountered many thunk-functions which all supposedly ...
- 143
1
vote
1
answer
575
views
how can ı debug encrypted dll with x32dbg and look getregistery request
I have an executable with 2 .dll calls 1 of this dll is guard.dll others name is guardlib.dll both of them is encrypted c++ library file and they are called before executable entry point.
I can bypass ...
- 13
1
vote
1
answer
97
views
How do you recommend going for applying minor changes in an executable through a dll?
My choice of words in the title might be poor, I apologize: english is not my primary language and I have no idea how to word it better.
I have a game executable to which I applied several changes, ...
- 41
0
votes
1
answer
6k
views
Getting Ghidra project to recognize referenced DLL
I am reverse engineering a very old game and when I load up the executable in Ghidra, I see a handful of imported dlls
I do however not see one of the DLLs the game uses to wrap various client ...
0
votes
0
answers
160
views
x64dbg how to find name of DLL not found
I have a program that hangs at start on my Window 10 system but runs ok on a VM running a vanilla Windows 10 system.
Using x64dbg I get to an error where it states a DLL is not found.
I have been ...
0
votes
0
answers
175
views
Debug dll file used in python script IDA
I am fairly new to RE on windows.
I have a python script which via ctypes uses functions from a dll.
I don't know if it's possible, but I would like to debug the dll used in the python script (the dll ...
- 1
0
votes
0
answers
150
views
Can I reverse engineer a DLL file and add SEH or some error handing codes to it?
I am using some DLL files in my Java application using JNI library.
The dlls are not written by me and I do not have access to their source codes. They are so buggy and throw lots of exceptions. ...
- 229
3
votes
0
answers
473
views
Is there a way to view the complete "Additional Information" log of Ghidra's "Import Results Summary"?
I'm currently trying to look into Q.U.B.E. 2's internal mechanics, so I decided to look at it using Ghidra. Q.U.B.E. 2 is built upon UnrealEngine, so it it's pretty big (~50 Mb's). However, when ...
- 131
4
votes
1
answer
247
views
what routine in ntdll.dll is responsible of dispatching DllMain function of loaded dll?
I'm trying to debug a dll file using Ida disassembler and Windbg.
I'm debugging rundll32.exe and passing the target dll (debugee) as an argument.
I'm able to have a breakpoint on each Dll load & ...
- 43
0
votes
0
answers
61
views
Specifying DLL imports within the PE?
I have unpacked and dumped a dll that uses a custom IAT to resolve Win32 API calls (143 of them).
Is there anyway to modify the dumped dll PE to include these imports dynamcially and forward their ...
- 19
2
votes
2
answers
599
views
How to decompile "call eax" in IDA Pro?
I know that there is a similar question but the answers didn't provide any fix for that problem.
I am decompiling a .dll file, and I have found out the subroutine that I needed, but it's throwing a "...
- 23
0
votes
1
answer
648
views
Loading a PE32 executable DLL Intel 80386 into a c# program
I'm new here so I'm sorry if this isn't the right section for my question.
I'm reverse engineering a software that's written in .net 3.5 c# which loads a weird dynamic dll, which has an important ...
2
votes
3
answers
323
views
How does an application identify a DLL file
Sorry if this is a basic question, as I'm very new at this.
I'm trying to get an .exe to load a dummy .dll. I've created an example .dll project in VC++ 2019, added the functions listed in the .exe's ...
- 21
2
votes
2
answers
290
views
Access DLL PE file by PEB dllbase address
I got the dllbase address from PEB InMemoryOrderModuleListItem list and I am trying to access the PE dos header file of a DLL. I am new to reverse engineering and in the past, I accessed the dos ...
- 123