Questions tagged [dll]
Dynamic-link library, or DLL, is Microsoft's implementation of the shared library concept in the Microsoft Windows and OS/2 operating systems.
207
questions
4
votes
1
answer
261
views
what routine in ntdll.dll is responsible of dispatching DllMain function of loaded dll?
I'm trying to debug a dll file using Ida disassembler and Windbg.
I'm debugging rundll32.exe and passing the target dll (debugee) as an argument.
I'm able to have a breakpoint on each Dll load & ...
- 43
0
votes
0
answers
62
views
Specifying DLL imports within the PE?
I have unpacked and dumped a dll that uses a custom IAT to resolve Win32 API calls (143 of them).
Is there anyway to modify the dumped dll PE to include these imports dynamcially and forward their ...
- 19
2
votes
2
answers
624
views
How to decompile "call eax" in IDA Pro?
I know that there is a similar question but the answers didn't provide any fix for that problem.
I am decompiling a .dll file, and I have found out the subroutine that I needed, but it's throwing a "...
- 23
0
votes
1
answer
709
views
Loading a PE32 executable DLL Intel 80386 into a c# program
I'm new here so I'm sorry if this isn't the right section for my question.
I'm reverse engineering a software that's written in .net 3.5 c# which loads a weird dynamic dll, which has an important ...
2
votes
3
answers
340
views
How does an application identify a DLL file
Sorry if this is a basic question, as I'm very new at this.
I'm trying to get an .exe to load a dummy .dll. I've created an example .dll project in VC++ 2019, added the functions listed in the .exe's ...
- 21
2
votes
2
answers
321
views
Access DLL PE file by PEB dllbase address
I got the dllbase address from PEB InMemoryOrderModuleListItem list and I am trying to access the PE dos header file of a DLL. I am new to reverse engineering and in the past, I accessed the dos ...
- 123
0
votes
0
answers
64
views
Develop a Hello World plugin for Ollydbg
I wanted to write a plugin for Ollydbg 2 which shows just a simple message. I write the following one but it doesn't load in ollydbg. I am using ollydbg 2 and my DLL can't load by it. Where is the ...
0
votes
1
answer
963
views
c++ reading process memory with injected DLL
The reading works fine until it reaches base+27.058.176(bytes) address. At this address VirtualProtect() failes with error 487 (Attempt to access invalid address).
Why does it return this error? Btw ...
- 11
2
votes
2
answers
261
views
Function Prologue, add esp directive
I need to see how a DLL was written and I am using a x32dbg to do it at run-time. I am a newbie to this reversing stuff, so I am confused with this piece of code:
push ebp ;...
- 23
6
votes
2
answers
1k
views
Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API
I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI.
I thought it would be a simple registry key being modified so I used RegShot to ...
- 111
0
votes
0
answers
133
views
How to call strongly encrypted DLL from Resources?
There is a program. This program accepts plugins. Plugins written with C#. I have to encrypt it. But when I use strong obfuscators I have exception. Program doesn't read. How can I fix that ? How can ...
- 1
1
vote
1
answer
824
views
Attach one debugger to a DotNet application, and a second one to a loaded DLL
I'm trying to reverse an application that is using a DLL that i'm interested in.
I can properly disassemble the application itself with DnSpy, as it is a .Net application, and I can disassemble the ...
- 699
1
vote
1
answer
2k
views
Ghidra can't Decompile kernelbase.dll exported functions?
I was trying to understand the IsDebuggerPresent() function exported by kernelbase.dll by importing the file on Ghidra. But Ghidra can't show me the proper disassembly or decompilation of function ...
- 66
0
votes
0
answers
299
views
reverse engineering obfuscated .net dll
I am decompiling a third party .NET dll which was obfuscated using codeveil
my aim is to get full source code,
I tried decompiling using dnSpy, JustDecompile & Reflector
however it just shows the ...
- 101
1
vote
1
answer
453
views
mfc140 dll , what is the usage?
While I open exe file in ida I can see lot of calls to mfc140_6153
or mfc140_8718.
What are those functions ? what they do ?
thanks
- 31
1
vote
2
answers
4k
views
How to debug a DLL written in .NET/C#?
I want to reverse engineer an application written in C#. I would like to set a breakpoint at a function and observe the input passed to it during the normal course of the application's functioning.
2
votes
1
answer
683
views
Start vs WinMain()
I am trying to analyze a malicious DLL and when I loaded it in IDA, I can see two functions - DLLEntryPoint and DLLMain. I then proceeded to change the format by switching the characteristics bit that ...
- 131
1
vote
1
answer
415
views
DLL obfuscator - what kind of obfuscator is this?
when I am looking for packet editor, I found open project on http://www.packeteditor.com/
when I learn how it works, I see that the application is injecting a dll named WSPE.dat, when I load this WSPE....
- 13
0
votes
1
answer
158
views
Exported DLL function has only stdcall with some offset
I am quite new to reverse engineering. I have opened .dll (x86) in IDA Pro and I have noticed few exported functions. The issue is that all of them looks like this:
IDA pseudocode:
int __stdcall ...
- 135
3
votes
3
answers
16k
views
Unity game: Assembly dll embedded inside the exe
I'm trying to reverse engineer a game made with the Unity engine, and usually all of the games's scripts are in the files \<Game>_Data\Managed\Assembly-CSharp.dll and \<Game>_Data\Managed\...
- 41
1
vote
0
answers
1k
views
Understand DLL function signature from ordinal
I'm trying with ghidra to reverse a 32-bit proprietary application that uses mfc42.dll and I'm obtaining mixed results with respect to imported functions.
To my surprise the DLLs don't use names to ...
- 111
3
votes
2
answers
2k
views
Permanently load a DLL to an executable
With the help of IDA I was able to hard-code changes into an executable by simply replacing some bytes with a hex editor, what I did was to change the resolution to something larger.
I've learnt that ...
- 31
1
vote
1
answer
762
views
Calling imported DLL functions from an injected DLL?
If I have injected my own DLL into an executable (a game specifically) which imports a DLL to draw its graphics, camera, etc. How can I go about calling the DLLs functions?
I'm able to find the ...
1
vote
0
answers
1k
views
Dump packed dll
I am trying to analyze lua functions of game but dll is packed and I can't see them. I tried to dump dll with scylla https://github.com/NtQuery/Scylla but I still didn't get lua functions. Can someone ...
- 11
1
vote
1
answer
106
views
When can trapping be used?
This is the beginning of one of the functions inside NTDLL of Windows XP:
MOV EDI,EDI
PUSH EBP
MOV EBP,ESP
...
The book on reverse engineering I am reading(Eldad Eilam - Reversing: Secrets of ...
- 55
3
votes
1
answer
3k
views
What is the difference between kernelBase.dll and Kernel32.dll
What is the difference between kernelBase.dll and Kernel32.dll in system32 folder ?
Why both of them implement WideCharToMultiByte ?
- 41
4
votes
3
answers
3k
views
Get interface definition of undocumented COM objects
I have started exploring COM objects, initially I got to it from UAC bypass methods but I guess my question is general. The general question is: How can I get from (elevated) CLSID in the registry to ...
- 143
12
votes
2
answers
3k
views
What kind of code would produce this assemby with loads of jump statements?
00EE16CC . E9 DFBB0000 JMP BinFile.00EED2B0
00EE16D1 . E9 64AF0000 JMP <JMP.&MSVCP140D.?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@>
00EE16D6 . E9 15DB0000 JMP BinFile....
- 135
3
votes
2
answers
2k
views
Syscall from ntdll.dll
I am begginer in RE and also in Win NT world.
I used IDA to disassemble ntdll.dll from Win XP SP 3. I care about non oficially documented function NtCreatePort which creates LPC port. I would find out ...
- 31
1
vote
1
answer
661
views
VirtualProtect failed to revert protections on mrdata section of ntdll, why?
i perform a loop in assembly where i am parsing the sections of ntdll change their memory permissions with VirtualProtect and then revert them back to their original permissions. the code looks like ...
- 41
0
votes
2
answers
108
views
How are images found inside DLLs accessed? [closed]
Sometimes a program displays images that don't exist as jpegs or bmps that come with the program so they have to be residing inside the exe itself or inside a DLL that comes with the program. So My ...
- 135
1
vote
1
answer
732
views
What is ObjectStublessClientXX in ole32dll?
When I do dynamic reversing I saw usage with ObjectStublessClientXX in ole32.dll .
What is that function? What does it do?
Is there any way that it supposed to transfer message between 2 processes? ...
- 513
3
votes
2
answers
8k
views
Comparison between orginal and modified DLL files with x64dbg
Is it possible to find the modifications between a original DLL file and a modified one using x64dbg?
And, if I can't do it with x64dbg, what tool would be better than a debugger to find the ...
- 31
1
vote
1
answer
2k
views
Outputting a patched DLL from x64dbg
I've been working on reversing an extremely outdated piece of software that I happen to need in order to get at the information stored in some equally outdated "database" files.
Using x64dbg, I've ...
2
votes
2
answers
424
views
Is there a good place to search information about known DLLs?
I'm just starting in learning some Reverse Engineering and there are a lot of DLLs being imported or called at runtime and I'd like to know what they do. I would have expected that there would be ...
- 380
7
votes
2
answers
4k
views
How can I access an internal DLL function or piece of data externally?
I'm writing in C++ and doing an exercise to familiarize myself with DLLs and shared objects (.so). How can I access internals without exporting them? GetProcAddress returns null on a call of an ...
- 380
0
votes
1
answer
204
views
Help Needed reversing a function inside a DLL [closed]
I have a broken installation of Metalogix Archive Manager (MAM). Sometimes, I need to go and retrieve attachments that this has archived when it was previously working.
The original attachment name ...
6
votes
1
answer
6k
views
dnSpy - What do these symbols mean?
When decompiling a dll file there are certain lines of code that read like this:
return \u0013.\u0002.\u0001(url, info);
I have two questions on this:
1) does \u00xx mean that it is obfuscated, if ...
- 437
1
vote
0
answers
253
views
Reverse engineering IE thick client
Internet Explorer allows for creating thick clients that run in the browser via a Browser Helper Object (BHO).
In trying to reverse one such thick client I noticed that the website downloads about ...
- 437
1
vote
1
answer
734
views
identifying function prototype from dll
I have an exe file and a dll file. This exe file uses the dll to decode input file. This exe file is gui based and does not support command line execution.
So my requirement is to create a program ...
- 13
2
votes
1
answer
1k
views
Decompile a DLL file from Microsoft Media Creation Tool
In this Superuser topic Windows 10 Media Creation Tool, how does it work?, it is possible to extract the URL from SetupMgr.dll. My question is, how do I extract this URL from SetupMgr.dll? I want to ...
3
votes
2
answers
9k
views
Dumping dll out of process
So there is executable malware, what when opened downloads dll from server or so and injects into target process. I checked properties of the target process in process hacker and clicked on .NET ...
- 31
0
votes
1
answer
676
views
How to build a 32-bit DLL in pure assembly
This is the code I've managed to build so far to implement DLLSkeleton.dll:
http://archive.org/download/lowlevelDLL32_try0000/x86_WinAPI_ASM_PE_EXE_Skeleton32--v2017-07-26.zip
I'm trying to make a ...
- 111
6
votes
1
answer
293
views
Returning value from faux DLL
A bit of background; I'm trying to inject my own code into the old game SimTower with the ultimate goal of reverse engineering it in the same way that OpenRCT2 was created.
Since SimTower is ...
- 165
1
vote
1
answer
490
views
Solving method of DLL crackme
I was given two DLL files (link) . The task is to get the flag from them. First what I've done - opened the first file (called original) in IDA and found the function called _GetFlag.
As I understood,...
- 125
1
vote
1
answer
410
views
See how classes are used in a Unity 3D game [closed]
I'm trying to understand how the procedural generation in a particular Unity 3D game works. I do not have the source code/project file, just a windows build.
I've opened up a dll called Assembly-...
- 113
2
votes
4
answers
3k
views
Unpacking xamarin mono dll from libmonodroid_bundle.app.so
I have an apk that was written in xamarin. The meta data suggests there are lots of dlls files this application uses. I found a file called libmonodroid_bundle_app.so which when disassembled in IDA ...
- 253
0
votes
1
answer
231
views
Bypass DLL by returning correct values? Or alternative technique
If this is the wrong spot for this, or is a duplicate, let me know.
I'm a computer professional getting started with decompiling and reverse engineering just for fun and resume building. I have a ...
- 101
0
votes
1
answer
2k
views
How can I dynamically debug a malicious DLL? [duplicate]
English isn't my first language, So I will do my best )
I am trying to analyze some malware NotPetya and I can run the malware by running :
rundll32.exe notpetya.dll #1
I am using Olly and trying ...
- 763
4
votes
2
answers
10k
views
How to edit and modify a class with ILSpy + Reflexil
In the Maxsea.SmartDesktop.dll, I want to edit and modify class b1g.
There is this in :
if (isCrackedResult != null && isCrackedResult.IsCracked)
and I want to modify for this :
if (...
- 41