Questions tagged [dll]
Dynamic-link library, or DLL, is Microsoft's implementation of the shared library concept in the Microsoft Windows and OS/2 operating systems.
208
questions
1
vote
0
answers
26
views
Anyway to hook to change file content and return for application keep read it?
is there anyway to modify v2 before statement if(v2) happen?
- 11
3
votes
0
answers
29
views
How to unpack emotet with x64dbg and do dynamic analysis?
I am a beginner at malware analysis. I have been trying to analyze Emotet using X64DBG. I followed the steps below and succeeded once, but when I repeated the same steps, I failed. Can you tell me if ...
- 453
2
votes
1
answer
842
views
How to mark data as pointer to external functions in ghidra
I'm examining a piece of malware with Ghidra, and like most malware it uses LoadLibrary and GetProcAddress to dynamically load libraries and functions. GetProcAddress stores the function addresses in ...
CommunityBot
- 1
2
votes
0
answers
47
views
What could be the reason-s for a exe not to load after a Dnspy modification to a DLL
After modifying a method of a DLL with Dnspy, the related EXE won't start.
What could be the reason for it not starting?
Here's what I did:
I modified a method from a DLL with Dnspy using edit Method ...
- 121
2
votes
1
answer
70
views
Use 3rd-party DLL in my own application
Sorry if this is a bit long; I figured it might be helpful to provide some information on why I'm trying to do what I'm doing. If not, just skip to the "My Problem" section.
Background
I'm ...
- 31
20
votes
9
answers
7k
views
Determining if a file is managed code or not
How can I quickly tell if a EXE or DLL I have is managed code or not?
I spent some time recently trying to disassemble a file and then later learned through some traces in the code that I could have ...
- 111
3
votes
1
answer
76
views
Load PDB for MemoryModule-loaded DLL in x64dbg
I need to debug a DLL, which I have a PDB file for.
The debug target is a program, that loads the DLL using MemoryModule library from Github.
The loaded module isn't listed as a module in x64dbg, ...
- 191
6
votes
2
answers
1k
views
Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API
I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI.
I thought it would be a simple registry key being modified so I used RegShot to ...
- 1
3
votes
0
answers
72
views
How to force IDA to load MFC DLL symbols while disassembling an EXE that uses such DLL?
I found that IDA may not load symbols for MFC DLLs while disassembling EXEs that load such DLLs. This makes the disassembling horrible if the DLL is linked just by ordinals, and IDA doesn't have a ...
0
votes
1
answer
977
views
c++ reading process memory with injected DLL
The reading works fine until it reaches base+27.058.176(bytes) address. At this address VirtualProtect() failes with error 487 (Attempt to access invalid address).
Why does it return this error? Btw ...
CommunityBot
- 1
3
votes
0
answers
73
views
PEStudio DLL analysis: flag in export section
I start to use PEStudio for DLL analysis; I understand (more or less) everything, except the "exports (flag)" section:
What does it mean the X in the flag column? So, what is a/the flag?
...
- 131
2
votes
0
answers
44
views
Decoding CalibrationL6.dll
I am having problems with a dll, it is called CalibrationL6.dll, I have been able to see the code inside, and the function that interests me is this:
public static int CalculateCoefficients(
...
- 21
2
votes
2
answers
1k
views
How to debug DLL injection in IDA?
Recently, I've been cracking a crackme DLL, and I need to inject it into a process, to see if it worked.
However, I've ran into a problem. I cannot seem to find how to debug DLL injection inside of ...
- 10.8k
5
votes
2
answers
4k
views
IDA Pro list COM methods
I have a dll file, containing some exported functions and COM methods.
Here is my dll information opened by DLL Export Viewer:
But when i open the dll file in ida pro, i see just exported functions ...
- 115
1
vote
1
answer
975
views
How to change the DLL name in the already compiled application?
I am trying to change the name of the DLL file I had specified for my application before compiling it. When I change the DLL file name I get the error message like:
System.IO.FileNotFoundException: ...
CommunityBot
- 1
2
votes
2
answers
315
views
turning decompiled C++ code into writable C++
Here's my scenario I currently have a DLL that was made in like 2003 archived that has data and functions I still need to use and I'm also 90% sure the DLL doesn't work correctly as its too outdated. (...
- 8,225
3
votes
2
answers
8k
views
Comparison between orginal and modified DLL files with x64dbg
Is it possible to find the modifications between a original DLL file and a modified one using x64dbg?
And, if I can't do it with x64dbg, what tool would be better than a debugger to find the ...
- 103
2
votes
1
answer
43
views
generate code execution/cpu time flame-graph of library DLL (Noob question)
I have a library DLL which I'm trying to analyze, and I have a basic understanding of its function and behavior (and can modify some input to affect how long certain operations will take to execute/...
- 15.8k
2
votes
0
answers
61
views
Can't view instructions inside the dll main function
I have a dll that is loaded by the program i'm reverse engineering, this dll only contains .text section without any exported functions, my guess is that dll main function contains something ...
CommunityBot
- 1
13
votes
5
answers
18k
views
Freely available resource hacking applications
I am using Resource Hacker as a tool to extract out resources like icon, images, etc. from .dll or .exe file. In addition, I am using it to crack some small Windows application. However, it does not ...
- 10.8k
3
votes
0
answers
107
views
Are system dlls like NTDLL and KERNELBASE etc. are always loaded at the same address on a per-session basis?
If I am understanding, code and read only sections of common DLLs are given system-wide section objects for which each process gets its own section view, in order to save physical memory. As such even ...
1
vote
0
answers
116
views
radare2: How to load a DLL along with the application?
I am reverse engineering a Windows application for which there is no PDB file available.
When loading it in r2, I get the following imports (They are correct):
nth vaddr bind type lib ...
- 11
0
votes
1
answer
148
views
Crackme assistance - unknown function [closed]
i have a problem about a crackme that my friend sent me for a bet. I solved most of it but i am stuck with this function. I can't even understand what the function is trying to do. Please help.
images ...
1
vote
2
answers
1k
views
Debug a .dll file within powershell
I have given a .ps1 file which loads a .dll via:
Import-Module ".\decrypter.dll"
After that, a call to that module is performed by:
get-decrypt(" *Some Base64 Encoded string* ")
Only the .dll is ...
70
votes
2
answers
43k
views
What is DLL Injection and how is it used for reversing?
I was reading a discussion about dumping a processes part of a process's memory and someone suggested using DLL injection to do this. I'll be honest in that I don't really understand. How does DLL ...
- 230
2
votes
0
answers
164
views
Compress Xamarin assemblies after decompression
I have an APK that has assemblies in a single blob file. I could extract them successfully using decompress-assemblies.
Is there anyway I can compress them again into assemblies.blob file or at least ...
- 21
3
votes
3
answers
2k
views
Modifying Windows DLLs
I find myself playing in strange territory lately, venturing far outside my comfort zone to test some theories. At present I want to return True every time a specific program calls IsDebuggerPresent, ...
- 10.8k
3
votes
1
answer
3k
views
What is the difference between kernelBase.dll and Kernel32.dll
What is the difference between kernelBase.dll and Kernel32.dll in system32 folder ?
Why both of them implement WideCharToMultiByte ?
- 1
1
vote
1
answer
49
views
Calling a function with a variable number of args from a proxy DLL
The program I'm messing with has builtin logging. Using a proxy DLL, I managed to activate it by calling the right functions from the real DLL. However, I got stuck at using the actual logging ...
- 1
1
vote
0
answers
80
views
How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime
In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
- 11
1
vote
1
answer
360
views
Exporting dll out of a process memory
Idk if this is asked before sorry
So I tried something with Process Hacker and Windbg but it couldn't help me
The dll is injected using CreateRemoteThread, LoadLibrary i tried looking through files ...
- 35.9k
0
votes
1
answer
73
views
How to detect incorrectly named DLL?
I am trying a simple lab on malware analysis and we were given both an .exe and .dll file.
However, I am told that the DLL will need to be renamed to something for it to work.
How do I go about ...
- 10.8k
2
votes
0
answers
128
views
Call function from dll
I am writing a program and I have injected "mydll" file into the program, but I cannot call the hello function in it. How can I call the hello function? My code:
import os
from ctypes import ...
- 21
0
votes
1
answer
254
views
Best way to monitor the access to a DLL of a software?
I'm currently analyzing a complex software which compiles a kind of code. By monitoring and correlating it with ProcMon I could figure out it loads a DLL as a module.
Now I'm trying to find out how ...
- 298
4
votes
2
answers
3k
views
How to do Global DLL injection
How can one go about injection of a DLL into every process? Can SetwindowsHookEx() do the trick? Does AppInit_DLLs work as it used to?
- 135
1
vote
1
answer
492
views
Find DllMain using IDA Freeware
I want to use the IDA Freeware Version 7.7 for finding the DllMain of a DLL file. The file is from the book Practical Malware Analysis. It is for Lab 05. Name of file is "Lab05-01.dll" and ...
- 38
1
vote
1
answer
63
views
funcion calls extern function without body
I wanted to look at how does the Windows API get the size of a file, so I opened kernel32.dll in a disassembler. I searched for GetFileSizeEx, and it seems to call a stub(?), but the disassembler ...
CommunityBot
- 1
30
votes
4
answers
13k
views
Can I statically link (not import) the Windows system DLLs?
I have compiled following C source code in VS2010 console project.
#include <stdio.h>
int main(int argc, char* argv[]){
printf("hello world\n");
return 0;
}
then I used /MT option for ...
- 1,100
18
votes
4
answers
5k
views
Server-side Query interception with MS SQL Server
I'm researching into intercepting queries that arrive at the SQL Server 2008 process.
SQLOS architecture is divided in the following system DLLs:
sqlmin.dll: Storage, replication, security features,...
2
votes
1
answer
454
views
How to hook to a system function
How to hook to external library function, such as OpenGL for example.
I have a function used by the program I am trying to change behaviour of. The function is:
lVar17 = glfwCreateWindow(uVar22,uVar25,...
- 8,758
1
vote
0
answers
115
views
Custom Chromium build - find registered extension's JS code
I have a custom chromium browser build which has a bunch of "native" functions which I would like to have definitions for.
Apparently, these are registered as en extension using this ...
- 11
1
vote
2
answers
10k
views
Can I know which function from which dll was called at runtime?
I'm new to reverse engineering, I want to find out which command in the Source2 Engine's console invokes which function (and in which DLL). For that, I was wondering how can I know:
which functions ...
0
votes
1
answer
213
views
How to declare a constructor in reversed class?
I wonder how to declare the reference to a constructor to a reversed class, i.e. I have a class say Game and it has a constructor at a certain address.
It is declared like this:
game.h
namespace ...
- 326
0
votes
0
answers
98
views
Starting out with reverse engineering. What assembly is disassembled code
I am new to reverse engineering and want to analyze my own exe/dll files. I took a look at nasm and masm and so far I have the feeling that this is unnecessary for me to learn in detail because it ...
- 101
1
vote
1
answer
510
views
How to step into an invoked method from a DotNet DLL in dnSpy?
I've been analyzing a malware written in C# using dnSpy. It loaded a dotnet assembly DLL from its Resources:
I tried stepping into InvokeMember function, but could not go further when hitting this ...
- 11
0
votes
1
answer
233
views
Proxy dll doesn't load the original dll
I have relatively simple code here for the proxy DllMain() function:
BOOL APIENTRY DllMain(HMODULE hDll, DWORD reason, LPVOID reserved)
{
if (reason != DLL_PROCESS_ATTACH) {
return TRUE;
}
...
- 326
1
vote
1
answer
53
views
What's the meaning of @ tag on proxy dll?
In proxy dll in .def file I can see the following notation:
_CreateFrameInfo=PROXY__CreateFrameInfo @1
Others use in the following format:
_AIL_3D_position@16 = vcruntime140_._AIL_3D_position@16
...
- 35.9k
0
votes
0
answers
2k
views
How to disassemble an obfuscated .NET DLL?
I asked earlier about unpacking a packed .NET exe. But now I need to see the source code for an obfuscated DLL:
Any idea how to unpack it?
- 1,517
2
votes
0
answers
90
views
The method of searching for similar code in a binary file of a new release
Got into the hands of such a task. There are two dlls. As the second file was explained to me (new.dll) this is a new release of the first file (old.dll). Both files are compiled for x64. I need to ...
- 21
1
vote
0
answers
192
views
Why rundll32.exe could be loading a DLL multiple times?
Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason.
Most of the time I use ...
- 11