Questions tagged [dll]

Dynamic-link library, or DLL, is Microsoft's implementation of the shared library concept in the Microsoft Windows and OS/2 operating systems.

40 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3 votes
0 answers
399 views

Is there a way to view the complete "Additional Information" log of Ghidra's "Import Results Summary"?

I'm currently trying to look into Q.U.B.E. 2's internal mechanics, so I decided to look at it using Ghidra. Q.U.B.E. 2 is built upon UnrealEngine, so it it's pretty big (~50 Mb's). However, when ...
3 votes
0 answers
240 views

Implementing call into compiled, undocumented, C DLL; divining exported function prototype

I've been attempting to build my own implementation of Nvidia's Surround functionality by using their DLLs within a more reliable and automatic system. I'm pretty new to this; I've been a programmer ...
  • 131
3 votes
0 answers
246 views

Puzzling behaviour when loading Wine's oleaut32.dll in OllyDbg

I was experimenting with debugging Windows programs under Wine and spotted this weird behaviour. When I check Wine's oleaut32.dll in OllyDbg I get different values in PE header compared to that what ...
2 votes
0 answers
38 views

Are system dlls like NTDLL and KERNELBASE etc. are always loaded at the same address on a per-session basis?

If I am understanding, code and read only sections of common DLLs are given system-wide section objects for which each process gets its own section view, in order to save physical memory. As such even ...
1 vote
0 answers
67 views

no global-metadata.dat file, only a game.dat file

I am currently working on a tool for an andoid app but there is a variable that I do not know how is calculated, so I wanted to get the Assembly-CSharp.dll file by using Il2CppDumper. But there isn't ...
  • 11
1 vote
0 answers
61 views

Compress Xamarin assemblies after decompression

I have an APK that has assemblies in a single blob file. I could extract them successfully using decompress-assemblies. Is there anyway I can compress them again into assemblies.blob file or at least ...
1 vote
0 answers
32 views

How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime

In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
1 vote
0 answers
77 views

Call function from dll

I am writing a program and I have injected "mydll" file into the program, but I cannot call the hello function in it. How can I call the hello function? My code: import os from ctypes import ...
1 vote
0 answers
55 views

Custom Chromium build - find registered extension's JS code

I have a custom chromium browser build which has a bunch of "native" functions which I would like to have definitions for. Apparently, these are registered as en extension using this ...
  • 11
1 vote
0 answers
58 views

The method of searching for similar code in a binary file of a new release

Got into the hands of such a task. There are two dlls. As the second file was explained to me (new.dll) this is a new release of the first file (old.dll). Both files are compiled for x64. I need to ...
  • 11
1 vote
1 answer
395 views

How to mark data as pointer to external functions in ghidra

I'm examining a piece of malware with Ghidra, and like most malware it uses LoadLibrary and GetProcAddress to dynamically load libraries and functions. GetProcAddress stores the function addresses in ...
1 vote
0 answers
87 views

How to retrieve the encryption key from a dll file?

I have a dll file that makes an http post request to a webserver , request looks something like this : UmdUsFrEB3wGMuuAz1Znywuedx6+...
  • 11
1 vote
0 answers
1k views

Understand DLL function signature from ordinal

I'm trying with ghidra to reverse a 32-bit proprietary application that uses mfc42.dll and I'm obtaining mixed results with respect to imported functions. To my surprise the DLLs don't use names to ...
  • 111
1 vote
0 answers
1k views

Dump packed dll

I am trying to analyze lua functions of game but dll is packed and I can't see them. I tried to dump dll with scylla https://github.com/NtQuery/Scylla but I still didn't get lua functions. Can someone ...
  • 11
1 vote
0 answers
248 views

Reverse engineering IE thick client

Internet Explorer allows for creating thick clients that run in the browser via a Browser Helper Object (BHO). In trying to reverse one such thick client I noticed that the website downloads about ...
  • 427
1 vote
0 answers
709 views

Reverse Engineering a whole project desktop application

Friends: i am trying to reverse engineer a CMS desktop application with the objective to make another with better functionallity; that CMS application contains 32 Dll´s; the idea is instead of create ...
1 vote
0 answers
560 views

Android shared Library (.so)

I quite quite new to reverse engineering in General and there are a couple of things I'm unsure of. The app I am reverse engineering uses a couple of android libs in order to sign requests. So far I'...
  • 31
1 vote
0 answers
207 views

Scanning memory accessed by a DLL

I would like to scan (or alternatively dump) memory that a DLL accesses while it's running. Scanning the application's (EXE) memory is not feasible (too large), and the DLL needs the application to ...
  • 51
1 vote
0 answers
3k views

How to turn a .dll file into a .exe file for ollydbg?

I have a dll file which I want to analyze/debug. To do that, I use ollydbg. But when I open the file with ollydbg then the following message appears : File 'C:\..........\Conficker.exe' is a ...
  • 1,491
1 vote
0 answers
290 views

Is there any technique called "DLL Replacement"?

I know a techinique is called: Process Replacement , I have searched but could not find any article about "DLL Replacement", in which malicious programs can replace a legal DLL (eg. a third party DLL) ...
  • 11
1 vote
0 answers
444 views

Calling Lua by C/C++ in compiled applications

So, currently I've been reverse engineering an application, that allows Lua coding. Because for some special purposes, I need to call Lua directly by C/C++ coding. However, as this application is ...
  • 31
0 votes
0 answers
41 views

radare2: How to load a DLL along with the application?

I am reverse engineering a Windows application for which there is no PDB file available. When loading it in r2, I get the following imports (They are correct): nth vaddr bind type lib ...
  • 1
0 votes
0 answers
22 views

Invalid memory access and class check in operator implementation

Say I have the following disassembled function, taken from my favourite 32 bit DLL that was compiled with an old version of MSVC: mov eax, ecx mov ecx, DWORD PTR [eax+4] cmp ecx, CAbstractBlitObj::`...
0 votes
0 answers
74 views

Reverse engineering Samsung Quick share UWP app

I want to make the Samsung Quick Share app work on my PC which is not from Samsung. So which DLL file would I have to reverse engineer to bypass that restriction, and how to get full access to UWP ...
0 votes
0 answers
91 views

Starting out with reverse engineering. What assembly is disassembled code

I am new to reverse engineering and want to analyze my own exe/dll files. I took a look at nasm and masm and so far I have the feeling that this is unnecessary for me to learn in detail because it ...
  • 101
0 votes
0 answers
812 views

How to disassemble an obfuscated .NET DLL?

I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL: Any idea how to unpack it?
  • 1,335
0 votes
0 answers
120 views

Why rundll32.exe could be loading a DLL multiple times?

Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason. Most of the time I use ...
0 votes
0 answers
89 views

Editing assembly language to bypass the condition

I want to edit the compiled DLL code to bypass the variable checking condition. I tried to change the value in the condition but it causes an application crash. How can I "remove" this ...
  • 1
0 votes
0 answers
172 views

Adding an export entry into dll file

There is an dll file which i need to edit, Using PE Explorer option, Export Viewer i can see a long list of items and i suppose each entry is called "Export Function". Using notepad++ i can ...
  • 1
0 votes
0 answers
128 views

x64dbg how to find name of DLL not found

I have a program that hangs at start on my Window 10 system but runs ok on a VM running a vanilla Windows 10 system. Using x64dbg I get to an error where it states a DLL is not found. I have been ...
0 votes
0 answers
94 views

Debug dll file used in python script IDA

I am fairly new to RE on windows. I have a python script which via ctypes uses functions from a dll. I don't know if it's possible, but I would like to debug the dll used in the python script (the dll ...
0 votes
0 answers
69 views

Can I reverse engineer a DLL file and add SEH or some error handing codes to it?

I am using some DLL files in my Java application using JNI library. The dlls are not written by me and I do not have access to their source codes. They are so buggy and throw lots of exceptions. ...
  • 229
0 votes
0 answers
56 views

Specifying DLL imports within the PE?

I have unpacked and dumped a dll that uses a custom IAT to resolve Win32 API calls (143 of them). Is there anyway to modify the dumped dll PE to include these imports dynamcially and forward their ...
  • 19
0 votes
0 answers
57 views

Develop a Hello World plugin for Ollydbg

I wanted to write a plugin for Ollydbg 2 which shows just a simple message. I write the following one but it doesn't load in ollydbg. I am using ollydbg 2 and my DLL can't load by it. Where is the ...
0 votes
0 answers
115 views

How to call strongly encrypted DLL from Resources?

There is a program. This program accepts plugins. Plugins written with C#. I have to encrypt it. But when I use strong obfuscators I have exception. Program doesn't read. How can I fix that ? How can ...
  • 1
0 votes
0 answers
270 views

reverse engineering obfuscated .net dll

I am decompiling a third party .NET dll which was obfuscated using codeveil my aim is to get full source code, I tried decompiling using dnSpy, JustDecompile & Reflector however it just shows the ...
0 votes
0 answers
333 views

X32DBG ignores dependent DLL

I have EXE file which calls one specific DLL among other system DLLs. When I change a string value in this specific DLL I can see the changes when I execute the EXE file. For example I can change text ...
0 votes
0 answers
870 views

How to change the DLL name in the already compiled application?

I am trying to change the name of the DLL file I had specified for my application before compiling it. When I change the DLL file name I get the error message like: System.IO.FileNotFoundException: ...
  • 599
0 votes
1 answer
894 views

How to debug DLL injection in IDA?

Recently, I've been cracking a crackme DLL, and I need to inject it into a process, to see if it worked. However, I've ran into a problem. I cannot seem to find how to debug DLL injection inside of ...
-1 votes
1 answer
730 views

c++ reading process memory with injected DLL

The reading works fine until it reaches base+27.058.176(bytes) address. At this address VirtualProtect() failes with error 487 (Attempt to access invalid address). Why does it return this error? Btw ...