Questions tagged [dll]

Dynamic-link library, or DLL, is Microsoft's implementation of the shared library concept in the Microsoft Windows and OS/2 operating systems.

Filter by
Sorted by
Tagged with
0 votes
0 answers
10 views

Compress Xamarin assemblies after decompression

I have an APK that has assemblies in a single blob file. I could extract them successfully using decompress-assemblies. Is there anyway I can compress them again into assemblies.blob file or at least ...
user avatar
1 vote
1 answer
27 views

Calling a function with a variable number of args from a proxy DLL

The program I'm messing with has builtin logging. Using a proxy DLL, I managed to activate it by calling the right functions from the real DLL. However, I got stuck at using the actual logging ...
user avatar
1 vote
0 answers
28 views

How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime

In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
user avatar
1 vote
1 answer
90 views

Exporting dll out of a process memory

Idk if this is asked before sorry So I tried something with Process Hacker and Windbg but it couldn't help me The dll is injected using CreateRemoteThread, LoadLibrary i tried looking through files ...
user avatar
  • 13
0 votes
1 answer
46 views

How to detect incorrectly named DLL?

I am trying a simple lab on malware analysis and we were given both an .exe and .dll file. However, I am told that the DLL will need to be renamed to something for it to work. How do I go about ...
user avatar
  • 1
1 vote
0 answers
55 views

Call function from dll

I am writing a program and I have injected "mydll" file into the program, but I cannot call the hello function in it. How can I call the hello function? My code: import os from ctypes import ...
user avatar
0 votes
1 answer
59 views

Best way to monitor the access to a DLL of a software?

I'm currently analyzing a complex software which compiles a kind of code. By monitoring and correlating it with ProcMon I could figure out it loads a DLL as a module. Now I'm trying to find out how ...
user avatar
1 vote
1 answer
163 views

Find DllMain using IDA Freeware

I want to use the IDA Freeware Version 7.7 for finding the DllMain of a DLL file. The file is from the book Practical Malware Analysis. It is for Lab 05. Name of file is "Lab05-01.dll" and ...
user avatar
0 votes
0 answers
22 views

Invalid memory access and class check in operator implementation

Say I have the following disassembled function, taken from my favourite 32 bit DLL that was compiled with an old version of MSVC: mov eax, ecx mov ecx, DWORD PTR [eax+4] cmp ecx, CAbstractBlitObj::`...
user avatar
1 vote
1 answer
55 views

funcion calls extern function without body

I wanted to look at how does the Windows API get the size of a file, so I opened kernel32.dll in a disassembler. I searched for GetFileSizeEx, and it seems to call a stub(?), but the disassembler ...
user avatar
  • 25
2 votes
1 answer
236 views

How to hook to a system function

How to hook to external library function, such as OpenGL for example. I have a function used by the program I am trying to change behaviour of. The function is: lVar17 = glfwCreateWindow(uVar22,uVar25,...
user avatar
  • 146
1 vote
0 answers
29 views

Custom Chromium build - find registered extension's JS code

I have a custom chromium browser build which has a bunch of "native" functions which I would like to have definitions for. Apparently, these are registered as en extension using this ...
user avatar
  • 11
0 votes
0 answers
70 views

Reverse engineering Samsung Quick share UWP app

I want to make the Samsung Quick Share app work on my PC which is not from Samsung. So which DLL file would I have to reverse engineer to bypass that restriction, and how to get full access to UWP ...
user avatar
0 votes
1 answer
99 views

How to declare a constructor in reversed class?

I wonder how to declare the reference to a constructor to a reversed class, i.e. I have a class say Game and it has a constructor at a certain address. It is declared like this: game.h namespace ...
user avatar
  • 146
0 votes
0 answers
85 views

Starting out with reverse engineering. What assembly is disassembled code

I am new to reverse engineering and want to analyze my own exe/dll files. I took a look at nasm and masm and so far I have the feeling that this is unnecessary for me to learn in detail because it ...
user avatar
  • 101
1 vote
1 answer
95 views

How to step into an invoked method from a DotNet DLL in dnSpy?

I've been analyzing a malware written in C# using dnSpy. It loaded a dotnet assembly DLL from its Resources: I tried stepping into InvokeMember function, but could not go further when hitting this ...
user avatar
0 votes
1 answer
131 views

Proxy dll doesn't load the original dll

I have relatively simple code here for the proxy DllMain() function: BOOL APIENTRY DllMain(HMODULE hDll, DWORD reason, LPVOID reserved) { if (reason != DLL_PROCESS_ATTACH) { return TRUE; } ...
user avatar
  • 146
1 vote
1 answer
48 views

What's the meaning of @ tag on proxy dll?

In proxy dll in .def file I can see the following notation: _CreateFrameInfo=PROXY__CreateFrameInfo @1 Others use in the following format: _AIL_3D_position@16 = vcruntime140_._AIL_3D_position@16 ...
user avatar
  • 146
0 votes
0 answers
33 views

How to modify a function without disassembling the entire class

If I want to modify a function which has calls to other classes and functions in the application, but I don't want to reverse all of those other classes and leave them as they are, how do I go about ...
user avatar
  • 146
0 votes
0 answers
584 views

How to disassemble an obfuscated .NET DLL?

I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL: Any idea how to unpack it?
user avatar
  • 1,295
1 vote
0 answers
55 views

The method of searching for similar code in a binary file of a new release

Got into the hands of such a task. There are two dlls. As the second file was explained to me (new.dll) this is a new release of the first file (old.dll). Both files are compiled for x64. I need to ...
user avatar
  • 11
0 votes
0 answers
108 views

Why rundll32.exe could be loading a DLL multiple times?

Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason. Most of the time I use ...
user avatar
1 vote
1 answer
280 views

How to mark data as pointer to external functions in ghidra

I'm examining a piece of malware with Ghidra, and like most malware it uses LoadLibrary and GetProcAddress to dynamically load libraries and functions. GetProcAddress stores the function addresses in ...
user avatar
6 votes
1 answer
3k views

Why can C# applications be reverse-compiled with variable names while C++ ones can't?

Why can programs written in C# be reverse-compiled essentially to their original form with variables names (such as dnSpy) while C++ decompilers (such as Ghidra) are unable to decode the variable ...
user avatar
1 vote
0 answers
68 views

How to retrieve the encryption key from a dll file?

I have a dll file that makes an http post request to a webserver , request looks something like this : UmdUsFrEB3wGMuuAz1Znywuedx6+...
user avatar
  • 11
0 votes
0 answers
70 views

Editing assembly language to bypass the condition

I want to edit the compiled DLL code to bypass the variable checking condition. I tried to change the value in the condition but it causes an application crash. How can I "remove" this ...
user avatar
  • 1
0 votes
1 answer
74 views

FINDING & EXECUTING a function from an exe/dll (not compiled by me)?

my Problem is, i have bought a Huion Kamvas 22 Plus pen display for drawing and painting. On my old Wacom tablet i had some hardware buttons and could map functions/setting of the driver to these ...
user avatar
0 votes
1 answer
122 views

open decompiler view of current module (dll) in dynamic analysis

I have a program (P.exe) with several dependencies (A.dll, B.dll etc). I decompiled and studied B.dll, but at runtime, P.exe is using A.dll. The horizon is updating in ISA view-RIP, but I don't have ...
user avatar
  • 123
2 votes
1 answer
598 views

How do I execute "File -> Add To Program..." in a Ghidra script?

I'm reversing an old video game with large number of shared libraries, and in order to reference them all correctly (via "thunk" functions?) I think I need to import all of the raw files ...
user avatar
1 vote
2 answers
109 views

Cannot disassemble exported functions

I want to disassemble a function from Kernel32.dll to see what it does, but every single function I try looks like this in the decompiler: Function: jmp ds:Function_0 Where is the function? ...
user avatar
0 votes
0 answers
143 views

Adding an export entry into dll file

There is an dll file which i need to edit, Using PE Explorer option, Export Viewer i can see a long list of items and i suppose each entry is called "Export Function". Using notepad++ i can ...
user avatar
  • 1
3 votes
1 answer
706 views

Rebuild IAT after manually unpacking DLL

I've been trying to unpack this dll and I'm pretty sure that 0x7c3ea902 or 0x1007A9D2 (ASLR disabled) or simply 0x7A9D2 is OEP. But after dumping with OllyDumpEx and trying to fix IAT with ImpREC it ...
user avatar
  • 215
4 votes
1 answer
129 views

Statically recovering thunks in Windows x86_64 DLL

I just started working my way to reversing Windows binaries and I stumbled upon the Import Address Table. When reversing a particular DLL I encountered many thunk-functions which all supposedly ...
user avatar
  • 143
1 vote
1 answer
256 views

how can ı debug encrypted dll with x32dbg and look getregistery request

I have an executable with 2 .dll calls 1 of this dll is guard.dll others name is guardlib.dll both of them is encrypted c++ library file and they are called before executable entry point. I can bypass ...
user avatar
1 vote
1 answer
95 views

How do you recommend going for applying minor changes in an executable through a dll?

My choice of words in the title might be poor, I apologize: english is not my primary language and I have no idea how to word it better. I have a game executable to which I applied several changes, ...
user avatar
  • 31
0 votes
1 answer
3k views

Getting Ghidra project to recognize referenced DLL

I am reverse engineering a very old game and when I load up the executable in Ghidra, I see a handful of imported dlls I do however not see one of the DLLs the game uses to wrap various client ...
user avatar
0 votes
0 answers
111 views

x64dbg how to find name of DLL not found

I have a program that hangs at start on my Window 10 system but runs ok on a VM running a vanilla Windows 10 system. Using x64dbg I get to an error where it states a DLL is not found. I have been ...
user avatar
0 votes
0 answers
76 views

Debug dll file used in python script IDA

I am fairly new to RE on windows. I have a python script which via ctypes uses functions from a dll. I don't know if it's possible, but I would like to debug the dll used in the python script (the dll ...
user avatar
0 votes
0 answers
66 views

Can I reverse engineer a DLL file and add SEH or some error handing codes to it?

I am using some DLL files in my Java application using JNI library. The dlls are not written by me and I do not have access to their source codes. They are so buggy and throw lots of exceptions. ...
user avatar
  • 229
3 votes
0 answers
364 views

Is there a way to view the complete "Additional Information" log of Ghidra's "Import Results Summary"?

I'm currently trying to look into Q.U.B.E. 2's internal mechanics, so I decided to look at it using Ghidra. Q.U.B.E. 2 is built upon UnrealEngine, so it it's pretty big (~50 Mb's). However, when ...
user avatar
4 votes
1 answer
198 views

what routine in ntdll.dll is responsible of dispatching DllMain function of loaded dll?

I'm trying to debug a dll file using Ida disassembler and Windbg. I'm debugging rundll32.exe and passing the target dll (debugee) as an argument. I'm able to have a breakpoint on each Dll load & ...
user avatar
  • 43
0 votes
0 answers
54 views

Specifying DLL imports within the PE?

I have unpacked and dumped a dll that uses a custom IAT to resolve Win32 API calls (143 of them). Is there anyway to modify the dumped dll PE to include these imports dynamcially and forward their ...
user avatar
  • 19
2 votes
2 answers
452 views

How to decompile "call eax" in IDA Pro?

I know that there is a similar question but the answers didn't provide any fix for that problem. I am decompiling a .dll file, and I have found out the subroutine that I needed, but it's throwing a "...
user avatar
  • 23
0 votes
1 answer
419 views

Loading a PE32 executable DLL Intel 80386 into a c# program

I'm new here so I'm sorry if this isn't the right section for my question. I'm reverse engineering a software that's written in .net 3.5 c# which loads a weird dynamic dll, which has an important ...
user avatar
2 votes
3 answers
284 views

How does an application identify a DLL file

Sorry if this is a basic question, as I'm very new at this. I'm trying to get an .exe to load a dummy .dll. I've created an example .dll project in VC++ 2019, added the functions listed in the .exe's ...
user avatar
  • 21
2 votes
2 answers
161 views

Access DLL PE file by PEB dllbase address

I got the dllbase address from PEB InMemoryOrderModuleListItem list and I am trying to access the PE dos header file of a DLL. I am new to reverse engineering and in the past, I accessed the dos ...
user avatar
  • 123
0 votes
0 answers
55 views

Develop a Hello World plugin for Ollydbg

I wanted to write a plugin for Ollydbg 2 which shows just a simple message. I write the following one but it doesn't load in ollydbg. I am using ollydbg 2 and my DLL can't load by it. Where is the ...
user avatar
-1 votes
1 answer
618 views

c++ reading process memory with injected DLL

The reading works fine until it reaches base+27.058.176(bytes) address. At this address VirtualProtect() failes with error 487 (Attempt to access invalid address). Why does it return this error? Btw ...
user avatar
2 votes
2 answers
236 views

Function Prologue, add esp directive

I need to see how a DLL was written and I am using a x32dbg to do it at run-time. I am a newbie to this reversing stuff, so I am confused with this piece of code: push ebp ;...
user avatar
4 votes
1 answer
971 views

Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API

I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI. I thought it would be a simple registry key being modified so I used RegShot to ...
user avatar
  • 91