Questions tagged [dll]

Dynamic-link library, or DLL, is Microsoft's implementation of the shared library concept in the Microsoft Windows and OS/2 operating systems.

Filter by
Sorted by
Tagged with
3
votes
1answer
488 views

Do all drivers exist in Kernel mode?

I'm in the process of learning the Windows API and reversing in general, so I apologize if this is a fairly dumb question. After reading a section of 'Practical Malware Analysis' discussing the ...
1
vote
0answers
521 views

Android shared Library (.so)

I quite quite new to reverse engineering in General and there are a couple of things I'm unsure of. The app I am reverse engineering uses a couple of android libs in order to sign requests. So far I'...
3
votes
1answer
1k views

Why is this _DllMainCRTStartup calling convention not as expected?

I've been looking around at various DLLs on my computer lately and I thought a decent place to start was the image entry point (typically _DllMainCRTStartup). From what I can see of the CRT source ...
0
votes
3answers
356 views

Hex-Rays decompiles array to int

I decompiled one dll using Hex-Ray but it decompiled array type input argument of dll to int. Any idea how to handle this ?? double dzSell(int a1, double a2, int a3, int a4, int a5) int a1 is array ...
0
votes
1answer
148 views

Get DLL name with PyDBG and System_dll.py?

Is it possible to get the name and path of a DLL that is loaded by the application using PyDBG and System_dll.py? I have a script and PyDBG handles loaded dlls with just: dbg.set_callback(...
2
votes
2answers
263 views

Stepping through a program to figure out what subroutines are being called?

I've loaded a program into IDA + Hex-Rays, and decompiled it down to some C-like pseudo-code. Now, I am trying to figure out, for a single action that I am taking in the program, what code is being ...
3
votes
0answers
224 views

Implementing call into compiled, undocumented, C DLL; divining exported function prototype

I've been attempting to build my own implementation of Nvidia's Surround functionality by using their DLLs within a more reliable and automatic system. I'm pretty new to this; I've been a programmer ...
3
votes
2answers
6k views

Where can I find the 64-bit version of shell32.dll on Windows?

I'm trying to debug Control Panel and I'd like to disassemble shell32.dll. Because control panel is a 64-bit executable, it loads the 64-bit version of the dll (contrary to the name). When I view the ...
1
vote
1answer
2k views

Decompiling a windows 3.1, VisualBasic 3 exe. Do I need to decompile dll too? How?

New to decompiling, and code generally. Trying to decompile a windows 3.1 game (text adventure), so I can build it up again. Because at the moment it doesn't work (even on windows 3.1). I decompiled ...
5
votes
1answer
11k views

How to reverse a dll and call its functions?

I have got a custom.dll which is utilized in a larger application. The application executable imports this dll to use its functionality. But this functionality is not used through out the life cycle ...
2
votes
3answers
797 views

How to make a valid patch to bypass self checking security measure?

I have got a DLL file that I want to modify. Each time the executable file which imports the DLL is executed it performs a self checking process to find out whether the file is valid or not. How can I ...
1
vote
1answer
180 views

How can I find the implementation/source code of an interface in .NET?

So I'm disassembling the Winnov.Amalga.Core.Session.Common.dll, and trying to figure out how the WriteScriptCommand works. I'm absolutely new to .NET, so go easy on me, please. You can find the dll ...
0
votes
0answers
824 views

How to change the DLL name in the already compiled application?

I am trying to change the name of the DLL file I had specified for my application before compiling it. When I change the DLL file name I get the error message like: System.IO.FileNotFoundException: ...
0
votes
1answer
334 views

Some help with disassembled code understanding

I've got some windows dll file. This dll-file exports a couple of functions to read HDD with some unknown (to me) filesystem. So, I've launched IDA disassembler and started an investigation on how ...
2
votes
1answer
1k views

Set QWORD with a constant value in IDA Pro

At line #3 of a function, I have a QWORD at address 7FE875F3FE0 which resolves to a value of 85857490416 for which the function returns true. If not, the value is set to 0. I would like to know how ...
11
votes
1answer
28k views

How to debug the DLL of an EXE using IDA Pro?

I'm fairly new to the RE world, started right around a week and have gotten my hands dirty with some really good stuff on this website. Pardon my naive knowledge. Currently, I'm trying to reverse a ...
1
vote
1answer
116 views

Patch methods in COM dll

I have COM DLL with one class and one interface. When I open it with COMView I see all the methods in the class/interface. I want to modify the behavior of one method in this COM but I don't know how....
2
votes
1answer
1k views

How to analyse a poorly documented DLL API?

I'm working on a sensor with PSI5 interface and I'm using PSI Simulyzer box to simulate the environment during testing. This box comes with a software (some sort of digital oscilloscope) to make the ...
1
vote
1answer
355 views

finding a checksum function using static analysis (IDA)

I have an dll that is loaded into a 64 bit process, it performs two check sums (at least) one to keep up to date (it receives a 13 character long string from the net which I'm fairly certain is an in ...
0
votes
1answer
2k views

DLL entry point in memory

I've been looking into the PE format using a random DLL as a test case. When I look manually at the entry point specified in the optional header (and add the image base, because RVA) it doesn't match ...
1
vote
0answers
197 views

Scanning memory accessed by a DLL

I would like to scan (or alternatively dump) memory that a DLL accesses while it's running. Scanning the application's (EXE) memory is not feasible (too large), and the DLL needs the application to ...
3
votes
2answers
4k views

Fixing import table of unpacked DLL with ImpREC : ImpRec throws “invalid OEP!” error

I am trying to unpack a DLL and fix the import tables with ImpRec. However, I am stuck with this error. Following is what I have tried. Modified the flag in its PE header so that windows loads the ...
1
vote
1answer
546 views

Reverse-Engineer an application download in base64 [closed]

An application on my system downloads a .sys file (driver) via base64. What I mean is; the application requests a site, the site returns a huge base64-encoded string and then the .sys file is built ...
0
votes
1answer
152 views

Windows PKZIP encryption / compression calls might be altering password?

I have a DLL with the following code which decrypts and decompresses an old PKZip 2.0 file... basic_string<char,std::char_traits<char>,std::allocator<char> > basic_string<char,...
1
vote
1answer
1k views

Intercept serial check

I've been playing around with RE for a bit now and a friend sent over a crackme. I figured mise well try and crack it. The first thing I did was to put the executable into Exeinfo PE and there was ...
3
votes
1answer
284 views

Find exact dependency tree of a program

In order to port a program (32 bit) from Win XP to Win 7/8/10 (64 bit), I have to list its dependencies ( all the dependency tree if possible). I've tried several tools that I'm aware of: Dependency ...
1
vote
1answer
751 views

Cannot call function (properly) in C++

I am developing a DLL for the purpose of injecting it into a running process for a game. I've found the memory addresses to some key functions(via Immunity Debugger) and I am trying to call those ...
5
votes
1answer
1k views

DLL Injection search for procedures/variables

I am learning DLL injection basics and different techniques to achieve it, like using CreateProcess and LoadLibrary for example, or simply replacing a .dll in folder where the application to inject ...
1
vote
1answer
2k views

Name and Ordinal table pointers in export directory are NULL although DLL exports functions

I'm trying to explore the functions exported by profapi.dll and I came across a behavior that I can't explain. Reading about the PE binary format I gather that the export table has 3 tables (arrays):...
3
votes
1answer
669 views

Delay imported function not in export table

I've been reverse engineering a PE executable and I came across a behavior that I can't understand. The executable uses both shell32.dll and profapi.dll. I see that shell32.dll delay loads a function ...
2
votes
1answer
1k views

Found a way to make any program run with the discrete Nvidia dGPU. But I need a little help to finish implementing the injection

Nvidia Optimus is a major thorn in my side. I just bought a new laptop that is using this on-the-fly gpu switching crap. This means that unless an application starts by querying the GPU for 3D tech or ...
1
vote
0answers
3k views

How to turn a .dll file into a .exe file for ollydbg?

I have a dll file which I want to analyze/debug. To do that, I use ollydbg. But when I open the file with ollydbg then the following message appears : File 'C:\..........\Conficker.exe' is a ...
0
votes
1answer
3k views

LoadLibrary from memory

I use http://www.joachim-bauch.de/tutorials/loading-a-dll-from-memory/ to loadlibrary from memory. but when use in my code "throw" program crashing. What's the problem? code i use like this: #...
0
votes
1answer
407 views

Most efficient way to extend a program using a DLL [closed]

I have wrote a program in C++ and I built it as a DLL. I want to utilize functions that are in this DLL in another program to overwrite other functions. Unfortunately, they're not any exports and ...
0
votes
0answers
4k views

IDA sp analysis failed [duplicate]

I am trying to reverse engineer a DLL file, but I am getting this warning when it's loaded: As well, then on some of the functions error appears sp analysis failed like on this picture: Is it ...
0
votes
1answer
6k views

Reverse-engineering of an Unity dll

I'm working on a project which requires me to extract, edit, and reproduce part of a proprietary hash algorithm.. which is contained inside a dll. The dll is used by an Unity game, and includes Unity ...
1
vote
1answer
916 views

Using a DLL proxy fails due to an unknown error

I'm using a dll proxy with the code described here, but having tons of trouble. First, I use VS2012 on Windows 7 and the target is on Windows XP. So I needed to: Install VCRedist on the target ...
2
votes
1answer
6k views

Viewing an exported DLL function in OllyDbg - garbage code

Being rather new to the concept of RE, I wanted to try and take a look at the assembly code in one DLL that I know exports some functions. First, I used this tool - http://www.nirsoft.net/utils/...
1
vote
0answers
274 views

Is there any technique called “DLL Replacement”?

I know a techinique is called: Process Replacement , I have searched but could not find any article about "DLL Replacement", in which malicious programs can replace a legal DLL (eg. a third party DLL) ...
5
votes
2answers
4k views

How to hook the entry point of a DLL?

I have written a C API with support for static import hooking via overwriting the corresponding IAT entry of an exported function. It works nicely for older simple applications, but for more modern ...
2
votes
3answers
5k views

How to figure out which imported function(s) in a virus determine its behaviour?

I want to know how to find the functions which is interesting in malware tools. For example, I have a sample of unknown virus (this sample is lab01-01.exe in the book practical malware analysis lab1-...
3
votes
3answers
8k views

Decompiling windows photo viewer

I'm trying to decompile the windows photo viewer DLL files to try to tweak them, such as editing speed etc. Since this wasn't possible in the registry. When opening the files in a program such as ...
2
votes
1answer
1k views

IDApro subroutine analysis

I am using IDA to find out parameters of a routine in a DLL. I browsed to the routine in question and saw that IDA has automatically done that job for me and put a comment like this: ; ==============...
2
votes
1answer
2k views

kernel32.BaseThreadInitThunk without IAT

On starting notepad.exe with Ollydbg, I see that eax has a value that points at kernel32.BaseThreadInitThunk. notepad.exe does not seem to import kernel32.dll::BaseThreadInitThunk. I cannot find that ...
1
vote
0answers
391 views

Calling Lua by C/C++ in compiled applications

So, currently I've been reverse engineering an application, that allows Lua coding. Because for some special purposes, I need to call Lua directly by C/C++ coding. However, as this application is ...
3
votes
2answers
6k views

DLL - Dynamic Analysis on IDA

I'm "middle-new" in re and I have to debug a dll's function. How can I tell to IDA : start function XXX with parameters A, B and C ? Is there a solution or a plugin doing that ? I've tried doing that ...
6
votes
2answers
2k views

How to modify/replace a non exported function in a native code dll

I disassembled a misbehaving dll with IDA and identified the faulty code. Now I want to go one step further and replace the function with a self-written, hopefully less faulty one. The dll I'm talking ...
8
votes
2answers
300 views

What changes in MS Windows system libraries after restart?

I'm running a 64-bit MS Windows 7 with all updates installed. About 1 or 2 weeks ago I've noticed that whenever I restart the OS, the virtual memory pages (of whatever process), corresponding to ...
2
votes
2answers
342 views

How to interpret entries from Exports tab in ProcessHacker

I use ProcessHacker version 2.33 to inspect the functions which are exported by DLLs in running processes. In the screen-shot below you can see a few exported functions from a C++ application, along ...
2
votes
1answer
1k views

How to extract information from dll compiled in gcc with debug symbols?

I recently read that GCC annotates the source-code into the debug symbols it produces, although I haven't found any examples on how to retrieve this. If this is true, how can I view the data in the ...