Questions tagged [dll]

Dynamic-link library, or DLL, is Microsoft's implementation of the shared library concept in the Microsoft Windows and OS/2 operating systems.

Filter by
Sorted by
Tagged with
0
votes
0answers
23 views

How to mark data as pointer to external functions in ghidra

I'm examining a piece of malware with Ghidra, and like most malware it uses LoadLibrary and GetProcAddress to dynamically load libraries and functions. GetProcAddress stores the function addresses in ...
4
votes
1answer
2k views

Why can C# applications be reverse-compiled with variable names while C++ ones can't?

Why can programs written in C# be reverse-compiled essentially to their original form with variables names (such as dnSpy) while C++ decompilers (such as Ghidra) are unable to decode the variable ...
1
vote
0answers
37 views

How to retrieve the encryption key from a dll file?

I have a dll file that makes an http post request to a webserver , request looks something like this : UmdUsFrEB3wGMuuAz1Znywuedx6+...
0
votes
0answers
37 views

Editing assembly language to bypass the condition

I want to edit the compiled DLL code to bypass the variable checking condition. I tried to change the value in the condition but it causes an application crash. How can I "remove" this ...
0
votes
0answers
61 views

Add new bytes into DLL file

I have a source code of dll file from IDA Disassembler and Hex Editor. Now i want add new bytes (not overwrite). https://imgur.com/VtAK4sw I would like to add support for a new version of the ...
0
votes
0answers
24 views

c# - Eject Injected Dll From Proc. Then Re-Inject Capability

I made a simple c# application to inject .dll to given process. But I also want to have a capability to eject then depending on user's choice, can re-inject the same .dll to same process. I'm working ...
0
votes
0answers
33 views

When is a wide-character function called?

I am rather new to reversing and currently I am trying to reverse and understand one of the malware samples that seem to be used by DPRK actors to target security researchers. https://norfolkinfosec....
0
votes
1answer
50 views

FINDING & EXECUTING a function from an exe/dll (not compiled by me)?

my Problem is, i have bought a Huion Kamvas 22 Plus pen display for drawing and painting. On my old Wacom tablet i had some hardware buttons and could map functions/setting of the driver to these ...
0
votes
1answer
42 views

open decompiler view of current module (dll) in dynamic analysis

I have a program (P.exe) with several dependencies (A.dll, B.dll etc). I decompiled and studied B.dll, but at runtime, P.exe is using A.dll. The horizon is updating in ISA view-RIP, but I don't have ...
0
votes
1answer
75 views

How do I execute “File -> Add To Program…” in a Ghidra script?

I'm reversing an old video game with large number of shared libraries, and in order to reference them all correctly (via "thunk" functions?) I think I need to import all of the raw files ...
1
vote
2answers
51 views

Cannot disassemble exported functions

I want to disassemble a function from Kernel32.dll to see what it does, but every single function I try looks like this in the decompiler: Function: jmp ds:Function_0 Where is the function? ...
0
votes
0answers
62 views

Adding an export entry into dll file

There is an dll file which i need to edit, Using PE Explorer option, Export Viewer i can see a long list of items and i suppose each entry is called "Export Function". Using notepad++ i can ...
3
votes
1answer
233 views

Rebuild IAT after manually unpacking DLL

I've been trying to unpack this dll and I'm pretty sure that 0x7c3ea902 or 0x1007A9D2 (ASLR disabled) or simply 0x7A9D2 is OEP. But after dumping with OllyDumpEx and trying to fix IAT with ImpREC it ...
0
votes
0answers
23 views

Error 0xc00007b while trying to do DLL Proxying

I have been trying to do DLL Proxy to load my code on a target process. The dll I'm building is just the sample template that comes with Visual Studio. I've just added the function exports and a ...
4
votes
1answer
74 views

Statically recovering thunks in Windows x86_64 DLL

I just started working my way to reversing Windows binaries and I stumbled upon the Import Address Table. When reversing a particular DLL I encountered many thunk-functions which all supposedly ...
1
vote
1answer
51 views

how can ı debug encrypted dll with x32dbg and look getregistery request

I have an executable with 2 .dll calls 1 of this dll is guard.dll others name is guardlib.dll both of them is encrypted c++ library file and they are called before executable entry point. I can bypass ...
1
vote
1answer
73 views

How do you recommend going for applying minor changes in an executable through a dll?

My choice of words in the title might be poor, I apologize: english is not my primary language and I have no idea how to word it better. I have a game executable to which I applied several changes, ...
0
votes
1answer
484 views

Getting Ghidra project to recognize referenced DLL

I am reverse engineering a very old game and when I load up the executable in Ghidra, I see a handful of imported dlls I do however not see one of the DLLs the game uses to wrap various client ...
0
votes
0answers
28 views

ILSpy edits wont save .dll

(I'm on mac btw) So I want to try game hacking, and I've done some research. So I made a simple unity first-person shooter and built it, and I went into the files and found Assembly-Csharp.dll and I ...
0
votes
0answers
36 views

x64dbg how to find name of DLL not found

I have a program that hangs at start on my Window 10 system but runs ok on a VM running a vanilla Windows 10 system. Using x64dbg I get to an error where it states a DLL is not found. I have been ...
0
votes
0answers
71 views

.NET - What kind of obfuscation is this?

I'm currently performing some malicious DLL malware analysis, and I'm having some issues figuring out how to de-obfuscate this particular sample. It uses a lot of Reflective Assembly calls, and, a lot ...
0
votes
0answers
45 views

Debug dll file used in python script IDA

I am fairly new to RE on windows. I have a python script which via ctypes uses functions from a dll. I don't know if it's possible, but I would like to debug the dll used in the python script (the dll ...
0
votes
0answers
34 views

Finding RAM value in IDA Pro

At line #9 of a function, I have a variable that points to a RAM Cell. Actually I have a WORD at address E1C4. I would like to know how can I get value of this variable? I find a location where used ...
0
votes
0answers
52 views

Can I reverse engineer a DLL file and add SEH or some error handing codes to it?

I am using some DLL files in my Java application using JNI library. The dlls are not written by me and I do not have access to their source codes. They are so buggy and throw lots of exceptions. ...
2
votes
0answers
128 views

Is there a way to view the complete “Additional Information” log of Ghidra's “Import Results Summary”?

I'm currently trying to look into Q.U.B.E. 2's internal mechanics, so I decided to look at it using Ghidra. Q.U.B.E. 2 is built upon UnrealEngine, so it it's pretty big (~50 Mb's). However, when ...
4
votes
1answer
141 views

what routine in ntdll.dll is responsible of dispatching DllMain function of loaded dll?

I'm trying to debug a dll file using Ida disassembler and Windbg. I'm debugging rundll32.exe and passing the target dll (debugee) as an argument. I'm able to have a breakpoint on each Dll load & ...
0
votes
0answers
48 views

Specifying DLL imports within the PE?

I have unpacked and dumped a dll that uses a custom IAT to resolve Win32 API calls (143 of them). Is there anyway to modify the dumped dll PE to include these imports dynamcially and forward their ...
2
votes
2answers
206 views

How to decompile “call eax” in IDA Pro?

I know that there is a similar question but the answers didn't provide any fix for that problem. I am decompiling a .dll file, and I have found out the subroutine that I needed, but it's throwing a "...
0
votes
1answer
89 views

Loading a PE32 executable DLL Intel 80386 into a c# program

I'm new here so I'm sorry if this isn't the right section for my question. I'm reverse engineering a software that's written in .net 3.5 c# which loads a weird dynamic dll, which has an important ...
2
votes
3answers
190 views

How does an application identify a DLL file

Sorry if this is a basic question, as I'm very new at this. I'm trying to get an .exe to load a dummy .dll. I've created an example .dll project in VC++ 2019, added the functions listed in the .exe's ...
0
votes
0answers
26 views

How to visualize execution paths of dll in IDA pro

I'd like to know how to visualize execution paths of dll in IDA pro. I've used lighthouse with drcov to colorize the paths of exe, but I can't do it for dll. It's no problems for me if a way to ...
1
vote
2answers
68 views

Access DLL PE file by PEB dllbase address

I got the dllbase address from PEB InMemoryOrderModuleListItem list and I am trying to access the PE dos header file of a DLL. I am new to reverse engineering and in the past, I accessed the dos ...
0
votes
0answers
48 views

Develop a Hello World plugin for Ollydbg

I wanted to write a plugin for Ollydbg 2 which shows just a simple message. I write the following one but it doesn't load in ollydbg. I am using ollydbg 2 and my DLL can't load by it. Where is the ...
-1
votes
1answer
310 views

c++ reading process memory with injected DLL

The reading works fine until it reaches base+27.058.176(bytes) address. At this address VirtualProtect() failes with error 487 (Attempt to access invalid address). Why does it return this error? Btw ...
2
votes
2answers
151 views

Function Prologue, add esp directive

I need to see how a DLL was written and I am using a x32dbg to do it at run-time. I am a newbie to this reversing stuff, so I am confused with this piece of code: push ebp ;...
4
votes
1answer
659 views

Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API

I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI. I thought it would be a simple registry key being modified so I used RegShot to ...
0
votes
0answers
72 views

How to call strongly encrypted DLL from Resources?

There is a program. This program accepts plugins. Plugins written with C#. I have to encrypt it. But when I use strong obfuscators I have exception. Program doesn't read. How can I fix that ? How can ...
0
votes
1answer
315 views

Attach one debugger to a DotNet application, and a second one to a loaded DLL

I'm trying to reverse an application that is using a DLL that i'm interested in. I can properly disassemble the application itself with DnSpy, as it is a .Net application, and I can disassemble the ...
1
vote
1answer
646 views

Ghidra can't Decompile kernelbase.dll exported functions?

I was trying to understand the IsDebuggerPresent() function exported by kernelbase.dll by importing the file on Ghidra. But Ghidra can't show me the proper disassembly or decompilation of function ...
0
votes
0answers
166 views

reverse engineering obfuscated .net dll

I am decompiling a third party .NET dll which was obfuscated using codeveil my aim is to get full source code, I tried decompiling using dnSpy, JustDecompile & Reflector however it just shows the ...
1
vote
1answer
207 views

mfc140 dll , what is the usage?

While I open exe file in ida I can see lot of calls to mfc140_6153 or mfc140_8718. What are those functions ? what they do ? thanks
0
votes
0answers
234 views

X32DBG ignores dependent DLL

I have EXE file which calls one specific DLL among other system DLLs. When I change a string value in this specific DLL I can see the changes when I execute the EXE file. For example I can change text ...
1
vote
2answers
2k views

How to debug a DLL written in .NET/C#?

I want to reverse engineer an application written in C#. I would like to set a breakpoint at a function and observe the input passed to it during the normal course of the application's functioning.
2
votes
1answer
363 views

Start vs WinMain()

I am trying to analyze a malicious DLL and when I loaded it in IDA, I can see two functions - DLLEntryPoint and DLLMain. I then proceeded to change the format by switching the characteristics bit that ...
1
vote
1answer
242 views

DLL obfuscator - what kind of obfuscator is this?

when I am looking for packet editor, I found open project on http://www.packeteditor.com/ when I learn how it works, I see that the application is injecting a dll named WSPE.dat, when I load this WSPE....
0
votes
1answer
73 views

Exported DLL function has only stdcall with some offset

I am quite new to reverse engineering. I have opened .dll (x86) in IDA Pro and I have noticed few exported functions. The issue is that all of them looks like this: IDA pseudocode: int __stdcall ...
2
votes
3answers
9k views

Unity game: Assembly dll embedded inside the exe

I'm trying to reverse engineer a game made with the Unity engine, and usually all of the games's scripts are in the files \<Game>_Data\Managed\Assembly-CSharp.dll and \<Game>_Data\Managed\...
1
vote
0answers
615 views

Understand DLL function signature from ordinal

I'm trying with ghidra to reverse a 32-bit proprietary application that uses mfc42.dll and I'm obtaining mixed results with respect to imported functions. To my surprise the DLLs don't use names to ...
3
votes
2answers
770 views

Permanently load a DLL to an executable

With the help of IDA I was able to hard-code changes into an executable by simply replacing some bytes with a hex editor, what I did was to change the resolution to something larger. I've learnt that ...
0
votes
1answer
510 views

Calling imported DLL functions from an injected DLL?

If I have injected my own DLL into an executable (a game specifically) which imports a DLL to draw its graphics, camera, etc. How can I go about calling the DLLs functions? I'm able to find the ...