Questions tagged [dll]

Dynamic-link library, or DLL, is Microsoft's implementation of the shared library concept in the Microsoft Windows and OS/2 operating systems.

Filter by
Sorted by
Tagged with
62
votes
2answers
38k views

What is DLL Injection and how is it used for reversing?

I was reading a discussion about dumping a processes part of a process's memory and someone suggested using DLL injection to do this. I'll be honest in that I don't really understand. How does DLL ...
39
votes
8answers
70k views

Is there any way to decompile a .NET assembly or program?

Are there any tools available to take an already compiled .dll or .exe file that you know was compiled from C# or Visual Basic and obtain the original source code from it?
24
votes
3answers
10k views

Can I statically link (not import) the Windows system DLLs?

I have compiled following C source code in VS2010 console project. #include <stdio.h> int main(int argc, char* argv[]){ printf("hello world\n"); return 0; } then I used /MT option for ...
18
votes
1answer
29k views

Get the function prototypes from an unknown .dll

I have an unknown .dll from another program which I want to work with. With DLL Export Viewer I was able to find the exported functions. But to call them I need the information about the parameters ...
17
votes
8answers
5k views

Determining if a file is managed code or not

How can I quickly tell if a EXE or DLL I have is managed code or not? I spent some time recently trying to disassemble a file and then later learned through some traces in the code that I could have ...
17
votes
4answers
40k views

How can DLL injection be detected?

In this question on DLL injection multiple answers mention that DLL injection can be used to modify games, perhaps for the purposes of writing a bot. It seems desirable to be able to detect DLL ...
17
votes
4answers
5k views

Server-side Query interception with MS SQL Server

I'm researching into intercepting queries that arrive at the SQL Server 2008 process. SQLOS architecture is divided in the following system DLLs: sqlmin.dll: Storage, replication, security features,...
14
votes
3answers
18k views

Difference between DllMain and DllEntryPoint

I have a piece a malware to analyze. It is a DLL according to the IMAGE_FILE_HEADER->Characteristics. I was trying to do some dynamic analysis on it. I have done the following: Run it with ...
12
votes
2answers
3k views

What kind of code would produce this assemby with loads of jump statements?

00EE16CC . E9 DFBB0000 JMP BinFile.00EED2B0 00EE16D1 . E9 64AF0000 JMP <JMP.&MSVCP140D.?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@> 00EE16D6 . E9 15DB0000 JMP BinFile....
11
votes
1answer
27k views

How to debug the DLL of an EXE using IDA Pro?

I'm fairly new to the RE world, started right around a week and have gotten my hands dirty with some really good stuff on this website. Pardon my naive knowledge. Currently, I'm trying to reverse a ...
11
votes
1answer
21k views

Looking for exported symbols in a DLL with objdump?

I am a man full of contradictions, I am using Unix and, yet, I want to analyze a Microsoft Windows DLL. Usually, when looking for symbols in a dynamic or static library in the ELF World, one can ...
10
votes
5answers
16k views

Freely available resource hacking applications

I am using Resource Hacker as a tool to extract out resources like icon, images, etc. from .dll or .exe file. In addition, I am using it to crack some small Windows application. However, it does not ...
10
votes
1answer
5k views

Dll injection and GetProcAddress with the winapi

So i just read a little bit about how one would go about for injecting a dll into a running program on Wikipedia (the CreateRemoteThread idea). I followed the steps described and eventually got it ...
8
votes
2answers
300 views

What changes in MS Windows system libraries after restart?

I'm running a 64-bit MS Windows 7 with all updates installed. About 1 or 2 weeks ago I've noticed that whenever I restart the OS, the virtual memory pages (of whatever process), corresponding to ...
7
votes
3answers
2k views

How to force the loading of a DLL in Windows XP at a particular address

I need to run a debugger on an application and analyze its startup, however the main DLL gets loaded at different addresses every time, which makes my job much harder. How can I disable ASLR ...
7
votes
1answer
2k views

Reverse engineer a proprietary save/file format structure

I am working on automating some functionality within a closed-source third party application; I want to automate the creation of "Project Files" (in its simplest form, just a collection of video files ...
6
votes
2answers
22k views

What happens when a DLL is added to AppInit_DLL

I have a malware sample that adds a DLL to the registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs. There is malicious functionality in the DLL referenced by the ...
6
votes
2answers
2k views

How to modify/replace a non exported function in a native code dll

I disassembled a misbehaving dll with IDA and identified the faulty code. Now I want to go one step further and replace the function with a self-written, hopefully less faulty one. The dll I'm talking ...
6
votes
1answer
242 views

Returning value from faux DLL

A bit of background; I'm trying to inject my own code into the old game SimTower with the ultimate goal of reverse engineering it in the same way that OpenRCT2 was created. Since SimTower is ...
5
votes
2answers
3k views

How can I access an internal DLL function or piece of data externally?

I'm writing in C++ and doing an exercise to familiarize myself with DLLs and shared objects (.so). How can I access internals without exporting them? GetProcAddress returns null on a call of an ...
5
votes
2answers
4k views

How to hook the entry point of a DLL?

I have written a C API with support for static import hooking via overwriting the corresponding IAT entry of an exported function. It works nicely for older simple applications, but for more modern ...
5
votes
1answer
3k views

dnSpy - What do these symbols mean?

When decompiling a dll file there are certain lines of code that read like this: return \u0013.\u0002.\u0001(url, info); I have two questions on this: 1) does \u00xx mean that it is obfuscated, if ...
5
votes
2answers
3k views

IDA Pro list COM methods

I have a dll file, containing some exported functions and COM methods. Here is my dll information opened by DLL Export Viewer: But when i open the dll file in ida pro, i see just exported functions ...
5
votes
1answer
11k views

How to reverse a dll and call its functions?

I have got a custom.dll which is utilized in a larger application. The application executable imports this dll to use its functionality. But this functionality is not used through out the life cycle ...
5
votes
1answer
1k views

DLL Injection search for procedures/variables

I am learning DLL injection basics and different techniques to achieve it, like using CreateProcess and LoadLibrary for example, or simply replacing a .dll in folder where the application to inject ...
5
votes
2answers
441 views

Tool for checking for in-memory code modifications of loaded DLLs

A common anti-debugging practice is to overwrite functions such as DbgUiRemoteBreakin within ntdll.dll. Since in-memory representation of common libraries is always the same on each platform, it ...
4
votes
3answers
2k views

Get interface definition of undocumented COM objects

I have started exploring COM objects, initially I got to it from UAC bypass methods but I guess my question is general. The general question is: How can I get from (elevated) CLSID in the registry to ...
4
votes
3answers
3k views

How to call non-exported functions from dll?

I'm doing some reverse engineering of C++ dll. What I have achieved so far - is have a list of all functions inside and even source code (in pseudo-C or so) for most of them. Reading this source code ...
4
votes
2answers
3k views

How to do Global DLL injection

How can one go about injection of a DLL into every process? Can SetwindowsHookEx() do the trick? Does AppInit_DLLs work as it used to?
4
votes
1answer
245 views

Wierd names in import table

I'm trying to do a static analysis of a PE file to see what it does. While doing so, I stumbled upon some really wierd function names in my objdump DLL Name: msvcrt.dll vma: Hint/Ord Member-Name ...
4
votes
2answers
6k views

How to edit and modify a class with ILSpy + Reflexil

In the Maxsea.SmartDesktop.dll, I want to edit and modify class b1g. There is this in : if (isCrackedResult != null && isCrackedResult.IsCracked) and I want to modify for this : if (...
4
votes
1answer
92 views

what routine in ntdll.dll is responsible of dispatching DllMain function of loaded dll?

I'm trying to debug a dll file using Ida disassembler and Windbg. I'm debugging rundll32.exe and passing the target dll (debugee) as an argument. I'm able to have a breakpoint on each Dll load & ...
4
votes
2answers
538 views

Is there a tool for proxying a dll that doesn't require IDA Pro?

I found a github project that compiled cleanly on the first try (might be the first ever for me, yay!). No instructions, so I stumble around for a bit until I find an awful Youtube video... everything'...
4
votes
1answer
1k views

How to intercept a call to function with known name from known DLL

First of all I wasn't very much into reversing until now, so excuse me if my question is dumb. I have a windows DLL most likely made with Visual C++. It's been developed in 1998 and has Mfc42.dll (4....
3
votes
4answers
2k views

Dynamic Analysis for Shared Libraries?

Are there techniques for dynamic analysis of shared libraries? I know for example that DLLs have an entry point, but how about calling other exported functions? Do I need to write a custom executable ...
3
votes
1answer
488 views

Do all drivers exist in Kernel mode?

I'm in the process of learning the Windows API and reversing in general, so I apologize if this is a fairly dumb question. After reading a section of 'Practical Malware Analysis' discussing the ...
3
votes
3answers
8k views

Decompiling windows photo viewer

I'm trying to decompile the windows photo viewer DLL files to try to tweak them, such as editing speed etc. Since this wasn't possible in the registry. When opening the files in a program such as ...
3
votes
2answers
6k views

DLL - Dynamic Analysis on IDA

I'm "middle-new" in re and I have to debug a dll's function. How can I tell to IDA : start function XXX with parameters A, B and C ? Is there a solution or a plugin doing that ? I've tried doing that ...
3
votes
2answers
6k views

Where can I find the 64-bit version of shell32.dll on Windows?

I'm trying to debug Control Panel and I'd like to disassemble shell32.dll. Because control panel is a 64-bit executable, it loads the 64-bit version of the dll (contrary to the name). When I view the ...
3
votes
1answer
1k views

Why is this _DllMainCRTStartup calling convention not as expected?

I've been looking around at various DLLs on my computer lately and I thought a decent place to start was the image entry point (typically _DllMainCRTStartup). From what I can see of the CRT source ...
3
votes
2answers
1k views

Syscall from ntdll.dll

I am begginer in RE and also in Win NT world. I used IDA to disassemble ntdll.dll from Win XP SP 3. I care about non oficially documented function NtCreatePort which creates LPC port. I would find out ...
3
votes
2answers
1k views

Modifying Windows DLLs

I find myself playing in strange territory lately, venturing far outside my comfort zone to test some theories. At present I want to return True every time a specific program calls IsDebuggerPresent, ...
3
votes
1answer
284 views

Find exact dependency tree of a program

In order to port a program (32 bit) from Win XP to Win 7/8/10 (64 bit), I have to list its dependencies ( all the dependency tree if possible). I've tried several tools that I'm aware of: Dependency ...
3
votes
1answer
2k views

IDA Pro 64 bit disassembly error for system DLLs

I use IDA Pro 6.8.150428 (idaq64.exe) to disassemble system dlls (64 bit) e.g. ntdll.dll, kernel32.dll, etc. in Windows 10 64 bit. I found idaq64.exe correctly disassembling 64 bit sample applications ...
3
votes
2answers
4k views

Fixing import table of unpacked DLL with ImpREC : ImpRec throws “invalid OEP!” error

I am trying to unpack a DLL and fix the import tables with ImpRec. However, I am stuck with this error. Following is what I have tried. Modified the flag in its PE header so that windows loads the ...
3
votes
1answer
669 views

Delay imported function not in export table

I've been reverse engineering a PE executable and I came across a behavior that I can't understand. The executable uses both shell32.dll and profapi.dll. I see that shell32.dll delay loads a function ...
3
votes
1answer
1k views

Detect a process for being injected with a dll [duplicate]

I'm trying to figure out how can I detect a process for being injected with a dll. I found this thread but I couldn't figure out a simple way out of it. I want to clarify my intention: given a pid - ...
3
votes
2answers
1k views

IDA python, get address range of specific dll

I have the following IDA Python script. It is intended to break on first instruction of imported function when call comes from the module of interest: list = [] def set_cb(ea, name, ord): global ...
3
votes
0answers
224 views

Implementing call into compiled, undocumented, C DLL; divining exported function prototype

I've been attempting to build my own implementation of Nvidia's Surround functionality by using their DLLs within a more reliable and automatic system. I'm pretty new to this; I've been a programmer ...
3
votes
0answers
211 views

Puzzling behaviour when loading Wine's oleaut32.dll in OllyDbg

I was experimenting with debugging Windows programs under Wine and spotted this weird behaviour. When I check Wine's oleaut32.dll in OllyDbg I get different values in PE header compared to that what ...