Questions tagged [dll]
Dynamic-link library, or DLL, is Microsoft's implementation of the shared library concept in the Microsoft Windows and OS/2 operating systems.
20
questions
70
votes
2
answers
43k
views
What is DLL Injection and how is it used for reversing?
I was reading a discussion about dumping a processes part of a process's memory and someone suggested using DLL injection to do this. I'll be honest in that I don't really understand. How does DLL ...
- 1,527
41
votes
8
answers
80k
views
Is there any way to decompile a .NET assembly or program?
Are there any tools available to take an already compiled .dll or .exe file that you know was compiled from C# or Visual Basic and obtain the original source code from it?
- 907
24
votes
4
answers
48k
views
How can DLL injection be detected?
In this question on DLL injection multiple answers mention that DLL injection can be used to modify games, perhaps for the purposes of writing a bot. It seems desirable to be able to detect DLL ...
- 1,527
15
votes
3
answers
22k
views
Difference between DllMain and DllEntryPoint
I have a piece a malware to analyze. It is a DLL according to the IMAGE_FILE_HEADER->Characteristics. I was trying to do some dynamic analysis on it. I have done the following:
Run it with ...
- 491
3
votes
0
answers
257
views
Puzzling behaviour when loading Wine's oleaut32.dll in OllyDbg
I was experimenting with debugging Windows programs under Wine and spotted this weird behaviour.
When I check Wine's oleaut32.dll in OllyDbg I get different values in PE header
compared to that what ...
- 293
1
vote
1
answer
732
views
What is ObjectStublessClientXX in ole32dll?
When I do dynamic reversing I saw usage with ObjectStublessClientXX in ole32.dll .
What is that function? What does it do?
Is there any way that it supposed to transfer message between 2 processes? ...
- 513
30
votes
4
answers
13k
views
Can I statically link (not import) the Windows system DLLs?
I have compiled following C source code in VS2010 console project.
#include <stdio.h>
int main(int argc, char* argv[]){
printf("hello world\n");
return 0;
}
then I used /MT option for ...
- 603
20
votes
9
answers
7k
views
Determining if a file is managed code or not
How can I quickly tell if a EXE or DLL I have is managed code or not?
I spent some time recently trying to disassemble a file and then later learned through some traces in the code that I could have ...
- 373
13
votes
5
answers
18k
views
Freely available resource hacking applications
I am using Resource Hacker as a tool to extract out resources like icon, images, etc. from .dll or .exe file. In addition, I am using it to crack some small Windows application. However, it does not ...
11
votes
1
answer
5k
views
Dll injection and GetProcAddress with the winapi
So i just read a little bit about how one would go about for injecting a dll into a running program on Wikipedia (the CreateRemoteThread idea). I followed the steps described and eventually got it ...
- 369
6
votes
2
answers
1k
views
Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API
I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI.
I thought it would be a simple registry key being modified so I used RegShot to ...
- 111
4
votes
3
answers
3k
views
Get interface definition of undocumented COM objects
I have started exploring COM objects, initially I got to it from UAC bypass methods but I guess my question is general. The general question is: How can I get from (elevated) CLSID in the registry to ...
- 143
4
votes
1
answer
286
views
Wierd names in import table
I'm trying to do a static analysis of a PE file to see what it does.
While doing so, I stumbled upon some really wierd function names in my objdump
DLL Name: msvcrt.dll
vma: Hint/Ord Member-Name ...
- 153
4
votes
1
answer
3k
views
IDA Pro 64 bit disassembly error for system DLLs
I use IDA Pro 6.8.150428 (idaq64.exe) to disassemble system dlls (64 bit) e.g. ntdll.dll, kernel32.dll, etc. in Windows 10 64 bit. I found idaq64.exe correctly disassembling 64 bit sample applications ...
- 97
3
votes
1
answer
772
views
Delay imported function not in export table
I've been reverse engineering a PE executable and I came across a behavior that I can't understand. The executable uses both shell32.dll and profapi.dll. I see that shell32.dll delay loads a function ...
- 67
3
votes
1
answer
2k
views
How to intercept a call to function with known name from known DLL
First of all I wasn't very much into reversing until now, so excuse me if my question is dumb.
I have a windows DLL most likely made with Visual C++. It's been developed in 1998 and has Mfc42.dll (4....
- 131
3
votes
2
answers
2k
views
Permanently load a DLL to an executable
With the help of IDA I was able to hard-code changes into an executable by simply replacing some bytes with a hex editor, what I did was to change the resolution to something larger.
I've learnt that ...
- 31
2
votes
1
answer
3k
views
Where can be assembly-csharp.dll decrypted?
So I have an android game. Its Assembly-CSharp.dll causes .NET Reflector to show
File is not a portable executable. DOS header does not contain 'MZ'
signature
It's encrypted. The app seems to ...
- 165
2
votes
1
answer
2k
views
Set QWORD with a constant value in IDA Pro
At line #3 of a function, I have a QWORD at address 7FE875F3FE0 which resolves to a value of 85857490416 for which the function returns true. If not, the value is set to 0.
I would like to know how ...
- 345
0
votes
1
answer
205
views
How to declare a constructor in reversed class?
I wonder how to declare the reference to a constructor to a reversed class, i.e. I have a class say Game and it has a constructor at a certain address.
It is declared like this:
game.h
namespace ...
- 326