Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [dll]

Dynamic-link library, or DLL, is Microsoft's implementation of the shared library concept in the Microsoft Windows and OS/2 operating systems.

0
votes
0answers
16 views

Reverse Engineer the Galax RGB Lighting Utility

during the last week I tried to find a way to control the lighting on my Galax 1080Ti cause it's software sucks. I come up with this https://github.com/purpl3F0x/GalaxLightingControl . It needs the ...
1
vote
1answer
102 views

What is the difference between kernelBase.dll and Kernel32.dll

What is the difference between kernelBase.dll and Kernel32.dll in system32 folder ? Why both of them implement WideCharToMultiByte ?
0
votes
0answers
36 views

libraries in IDA import tab

When I look in the IDA import tab after opening mfc42.dll I see some function import from api-ms-win-core-string-l1-1-0 library and some of them api-ms-win-core-processthreads-l1-1-0 library . What ...
0
votes
0answers
36 views

Debugging two DLLs simultaneously in IDA

Having read How to debug the DLL of an EXE using IDA Pro, I know how to debug a DLL as called by an .exe. I have an '.exe' file that uses two distinct DLLs. How can I open both DLLs at the same time ...
4
votes
3answers
210 views

Get interface definition of undocumented COM objects

I have started exploring COM objects, initially I got to it from UAC bypass methods but I guess my question is general. The general question is: How can I get from (elevated) CLSID in the registry to ...
12
votes
2answers
3k views

What kind of code would produce this assemby with loads of jump statements?

00EE16CC . E9 DFBB0000 JMP BinFile.00EED2B0 00EE16D1 . E9 64AF0000 JMP <JMP.&MSVCP140D.?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@> 00EE16D6 . E9 15DB0000 JMP BinFile....
0
votes
0answers
35 views

How to load Inproc COM DLL in ollydbg?

How to load Inproc COM DLL in ollydbg? With the help of loaddll, it does not work, it gives an error Can't load library. In there are interfaces which are inherited from IUnknown 32 bit dll, ...
0
votes
0answers
26 views

Compare / highlight differences between 2 .dll files [duplicate]

so I have 2 .dlls and I was thinking if it's possible to easily compare/highlight the things that are different between the two with IDA or anything else you have in mind that could make that job ...
0
votes
2answers
161 views

Syscall from ntdll.dll

I am begginer in RE and also in Win NT world. I used IDA to disassemble ntdll.dll from Win XP SP 3. I care about non oficially documented function NtCreatePort which creates LPC port. I would find out ...
1
vote
1answer
103 views

VirtualProtect failed to revert protections on mrdata section of ntdll, why?

i perform a loop in assembly where i am parsing the sections of ntdll change their memory permissions with VirtualProtect and then revert them back to their original permissions. the code looks like ...
0
votes
2answers
74 views

How are images found inside DLLs accessed? [closed]

Sometimes a program displays images that don't exist as jpegs or bmps that come with the program so they have to be residing inside the exe itself or inside a DLL that comes with the program. So My ...
1
vote
1answer
112 views

What is ObjectStublessClientXX in ole32dll?

When I do dynamic reversing I saw usage with ObjectStublessClientXX in ole32.dll . What is that function? What does it do? Is there any way that it supposed to transfer message between 2 processes? ...
1
vote
2answers
283 views

Comparison between orginal and modified DLL files with x64dbg

Is it possible to find the modifications between a original DLL file and a modified one using x64dbg? And, if I can't do it with x64dbg, what tool would be better than a debugger to find the ...
1
vote
1answer
170 views

Outputting a patched DLL from x64dbg

I've been working on reversing an extremely outdated piece of software that I happen to need in order to get at the information stored in some equally outdated "database" files. Using x64dbg, I've ...
2
votes
2answers
101 views

Is there a good place to search information about known DLLs?

I'm just starting in learning some Reverse Engineering and there are a lot of DLLs being imported or called at runtime and I'd like to know what they do. I would have expected that there would be ...
3
votes
2answers
603 views

How can I access an internal DLL function or piece of data externally?

I'm writing in C++ and doing an exercise to familiarize myself with DLLs and shared objects (.so). How can I access internals without exporting them? GetProcAddress returns null on a call of an ...
0
votes
1answer
154 views

Help Needed reversing a function inside a DLL [closed]

I have a broken installation of Metalogix Archive Manager (MAM). Sometimes, I need to go and retrieve attachments that this has archived when it was previously working. The original attachment name ...
0
votes
0answers
161 views

xdbg64 loading dll with export function

anyone knows how to load a DLL in xdbg64 with parameter for the export function? eg. lets say x.dll with the following export functions routine & start how do I load x.dll into xdbg64 using the ...
5
votes
1answer
636 views

dnSpy - What do these symbols mean?

When decompiling a dll file there are certain lines of code that read like this: return \u0013.\u0002.\u0001(url, info); I have two questions on this: 1) does \u00xx mean that it is obfuscated, if ...
1
vote
0answers
65 views

Reverse engineering IE thick client

Internet Explorer allows for creating thick clients that run in the browser via a Browser Helper Object (BHO). In trying to reverse one such thick client I noticed that the website downloads about ...
0
votes
0answers
55 views

Environment Variables not found in Ollydbg

I tried loading a .dll file into Ollydbg, it loaded some Windows modules, and stopped at ntdll module with the following exception: Debugged program unable to process exception I checked the ...
1
vote
1answer
181 views

identifying function prototype from dll

I have an exe file and a dll file. This exe file uses the dll to decode input file. This exe file is gui based and does not support command line execution. So my requirement is to create a program ...
0
votes
1answer
270 views

Decompile a DLL file from Microsoft Media Creation Tool

In this Superuser topic Windows 10 Media Creation Tool, how does it work?, it is possible to extract the URL from SetupMgr.dll. My question is, how do I extract this URL from SetupMgr.dll? I want to ...
0
votes
2answers
770 views

Dumping dll out of process

So there is executable malware, what when opened downloads dll from server or so and injects into target process. I checked properties of the target process in process hacker and clicked on .NET ...
0
votes
1answer
211 views

How to build a 32-bit DLL in pure assembly

This is the code I've managed to build so far to implement DLLSkeleton.dll: http://archive.org/download/lowlevelDLL32_try0000/x86_WinAPI_ASM_PE_EXE_Skeleton32--v2017-07-26.zip I'm trying to make a ...
6
votes
1answer
183 views

Returning value from faux DLL

A bit of background; I'm trying to inject my own code into the old game SimTower with the ultimate goal of reverse engineering it in the same way that OpenRCT2 was created. Since SimTower is ...
1
vote
1answer
222 views

Solving method of DLL crackme

I was given two DLL files (link) . The task is to get the flag from them. First what I've done - opened the first file (called original) in IDA and found the function called _GetFlag. As I understood,...
1
vote
1answer
226 views

See how classes are used in a Unity 3D game [closed]

I'm trying to understand how the procedural generation in a particular Unity 3D game works. I do not have the source code/project file, just a windows build. I've opened up a dll called Assembly-...
0
votes
0answers
247 views

Finding source files from dll

I've been given an Excel model who's back-end has been written in c++ and linked via a dll file. The project file directory has the following structure: model | | - excel-model.xlsb | - excel-...
1
vote
4answers
837 views

Unpacking xamarin mono dll from libmonodroid_bundle.app.so

I have an apk that was written in xamarin. The meta data suggests there are lots of dlls files this application uses. I found a file called libmonodroid_bundle_app.so which when disassembled in IDA ...
0
votes
1answer
142 views

Bypass DLL by returning correct values? Or alternative technique

If this is the wrong spot for this, or is a duplicate, let me know. I'm a computer professional getting started with decompiling and reverse engineering just for fun and resume building. I have a ...
0
votes
1answer
770 views

How can I dynamically debug a malicious DLL? [duplicate]

English isn't my first language, So I will do my best ) I am trying to analyze some malware NotPetya and I can run the malware by running : rundll32.exe notpetya.dll #1 I am using Olly and trying ...
3
votes
2answers
2k views

How to edit and modify a class with ILSpy + Reflexil

In the Maxsea.SmartDesktop.dll, I want to edit and modify class b1g. There is this in : if (isCrackedResult != null && isCrackedResult.IsCracked) and I want to modify for this : if (...
3
votes
2answers
1k views

How to do Global DLL injection

How can one go about injection of a DLL into every process? Can SetwindowsHookEx() do the trick? Does AppInit_DLLs work as it used to?
1
vote
1answer
294 views

DLL Injection does not work twice

I created a program that performs DLL injection. It does that by opening the process with OpenProcess, writes the DLL path to the process and creates a remote thread with CreateRemoteThread with the ...
0
votes
1answer
433 views

How to debug DLL injection in IDA?

Recently, I've been cracking a crackme DLL, and I need to inject it into a process, to see if it worked. However, I've ran into a problem. I cannot seem to find how to debug DLL injection inside of ...
0
votes
1answer
103 views

Finding other segments of a manually mapped DLL having found the .text segment

I've been able to locate the .text section of the module, knowing the base address of that section and its size how would I be able to find the other segments of the DLL, like .rdata, .data, .bss, etc....
1
vote
2answers
1k views

Reverse Engineering visual basics programs

I am a beginner and I am doing a few crackme stuff, I'm pretty okay when it comes to system calls such as user32. But there is one crackme which uses msvbvm50.dll (Visual Basic) and it has weird ...
0
votes
1answer
455 views

Debug a .dll file within powershell

I have given a .ps1 file which loads a .dll via: Import-Module ".\decrypter.dll" After that, a call to that module is performed by: get-decrypt(" *Some Base64 Encoded string* ") Only the .dll is ...
4
votes
2answers
593 views

Detect a process for being injected with a dll [duplicate]

I'm trying to figure out how can I detect a process for being injected with a dll. I found this thread but I couldn't figure out a simple way out of it. I want to clarify my intention: given a pid - ...
1
vote
3answers
300 views

How to locate dynamic instructions?

I am trying to make a game hack and there are a few instructions I need to get the addresses of to nop out. However, when looking at the instructions in Cheat Engine, they do not have a static offset ...
0
votes
0answers
374 views

Launching old video game (Lineage II C3) on Windows 10 | Updated

Excuse me for my English There is one MMORPG, Lineage II, it was created in ~2002. From 2002 to the present it's evolved with so-called "chronicles" like this ~2004:Chronicle 1 | ~2005:Chronicle 2 | ...
1
vote
1answer
928 views

How to run and reconstruct a packed DLL in IDA Pro?

I have a packed DLL. It has an entry point. If I call LoadLibrary it gets unpacked with the entry point code. Then I can attach a debugger to the .exe that called LoadLibrary and see the unpacked dll ...
0
votes
0answers
143 views

Finding injected dll files in a running process? [duplicate]

I'm not very experienced with computer stuff, but i am looking for a way to see what .DLL files are injected to a current running process. Note: I'm not trying to prevent someone from injecting a ....
1
vote
1answer
2k views

Call DLL export in OllyDBG

I am using OllyDbg 2.01 and I walked through this tutorial to figure out how Call DLL export works. Even though it was written for another version of OllyDBG it work just fine. We should notice, that ...
1
vote
2answers
2k views

Can I know which function from which dll was called at runtime?

I'm new to reverse engineering, I want to find out which command in the Source2 Engine's console invokes which function (and in which DLL). For that, I was wondering how can I know: which functions ...
4
votes
2answers
654 views

Modifying Windows DLLs

I find myself playing in strange territory lately, venturing far outside my comfort zone to test some theories. At present I want to return True every time a specific program calls IsDebuggerPresent, ...
0
votes
0answers
47 views

Why is my second attempt not working even though it's “the same”?

First things first: I have here a few lines of a hack that I wrote: Here is the definition of a makro luaL_openlib which is actually a function pointer to 0x0090DE00: /* Type definitions for ...
1
vote
1answer
240 views

What is the quickest way to run code of my own DLL?

Not sure if the title is that telling but what I want to do is hack into an executable and do as little as necessary to get the code from my DLL running since I want to write as few lines of assembly ...
0
votes
0answers
506 views

Is there any way to decompile C# from RAM?

I finally understood how my C# (Unity) code can download DLL (.bytes) from server at runtime and execute it from RAM (no local file written AFAIK). So now I wonder if there's a tool to decompile from ...