Questions tagged [dll]
Dynamic-link library, or DLL, is Microsoft's implementation of the shared library concept in the Microsoft Windows and OS/2 operating systems.
207
questions
4
votes
2
answers
3k
views
How to do Global DLL injection
How can one go about injection of a DLL into every process? Can SetwindowsHookEx() do the trick? Does AppInit_DLLs work as it used to?
- 41
2
votes
1
answer
1k
views
DLL Injection does not work twice
I created a program that performs DLL injection. It does that by opening the process with OpenProcess, writes the DLL path to the process and creates a remote thread with CreateRemoteThread with the ...
- 385
2
votes
2
answers
1k
views
How to debug DLL injection in IDA?
Recently, I've been cracking a crackme DLL, and I need to inject it into a process, to see if it worked.
However, I've ran into a problem. I cannot seem to find how to debug DLL injection inside of ...
- 31
0
votes
1
answer
227
views
Finding other segments of a manually mapped DLL having found the .text segment
I've been able to locate the .text section of the module, knowing the base address of that section and its size how would I be able to find the other segments of the DLL, like .rdata, .data, .bss, etc....
- 115
1
vote
2
answers
3k
views
Reverse Engineering visual basics programs
I am a beginner and I am doing a few crackme stuff, I'm pretty okay when it comes to system calls such as user32.
But there is one crackme which uses msvbvm50.dll (Visual Basic)
and it has weird ...
- 21
1
vote
2
answers
1k
views
Debug a .dll file within powershell
I have given a .ps1 file which loads a .dll via:
Import-Module ".\decrypter.dll"
After that, a call to that module is performed by:
get-decrypt(" *Some Base64 Encoded string* ")
Only the .dll is ...
- 13
3
votes
1
answer
2k
views
Detect a process for being injected with a dll [duplicate]
I'm trying to figure out how can I detect a process for being injected with a dll.
I found this thread but I couldn't figure out a simple way out of it.
I want to clarify my intention: given a pid - ...
- 31
1
vote
3
answers
1k
views
How to locate dynamic instructions?
I am trying to make a game hack and there are a few instructions I need to get the addresses of to nop out. However, when looking at the instructions in Cheat Engine, they do not have a static offset ...
- 11
0
votes
1
answer
3k
views
How to run and reconstruct a packed DLL in IDA Pro?
I have a packed DLL. It has an entry point. If I call LoadLibrary it gets unpacked with the entry point code. Then I can attach a debugger to the .exe that called LoadLibrary and see the unpacked dll ...
- 103
1
vote
1
answer
3k
views
Call DLL export in OllyDBG
I am using OllyDbg 2.01 and I walked through this tutorial to figure out how Call DLL export works. Even though it was written for another version of OllyDBG it work just fine. We should notice, that ...
- 124
1
vote
2
answers
10k
views
Can I know which function from which dll was called at runtime?
I'm new to reverse engineering, I want to find out which command in the Source2 Engine's console invokes which function (and in which DLL). For that, I was wondering how can I know:
which functions ...
- 113
3
votes
3
answers
2k
views
Modifying Windows DLLs
I find myself playing in strange territory lately, venturing far outside my comfort zone to test some theories. At present I want to return True every time a specific program calls IsDebuggerPresent, ...
- 83
1
vote
1
answer
348
views
What is the quickest way to run code of my own DLL?
Not sure if the title is that telling but what I want to do is hack into an executable and do as little as necessary to get the code from my DLL running since I want to write as few lines of assembly ...
- 171
1
vote
0
answers
92
views
Am I seeing this dll's innards correctly? [closed]
The dll in question is custom, from a retail/consumer software package that was first offered for sale in 2006/2007. I am fairly confident that it was compiled with Visual Studio .NET (2003).
My ...
- 189
0
votes
1
answer
2k
views
Patch packed DLL by themida [closed]
How to patch dll file packed by themida? I've dumped the unpacked file and patched it. But the program didn't recognize the unpacked dll. The original file and dumped file have ~8mb different size.
I ...
- 3
4
votes
2
answers
675
views
Is there a tool for proxying a dll that doesn't require IDA Pro?
I found a github project that compiled cleanly on the first try (might be the first ever for me, yay!). No instructions, so I stumble around for a bit until I find an awful Youtube video... everything'...
- 189
3
votes
1
answer
956
views
How do I call a statically imported function from a Dll? call dword ptr ds <> not working
Disclaimer: I am relatively new to this whole RE thing. So I successfully crammed some instructions into the end of an existing DLL and redirected a call.
Now I actually want to do things with a ...
- 53
2
votes
4
answers
3k
views
Locate address of function in DLL
I need to locate the address of a function in a DLL at runtime which isn't exported. The DLL in question is vbe7.dll related to Visual Basic (and macros). The function is ___vbaInStr, can be found in ...
- 21
0
votes
1
answer
3k
views
Call function of injected dll
I am messing around with dll injections. I am able to inject a dll with an exported function into some process, but I have a question now:
Is there a standard way to call the exported function of my ...
- 27
3
votes
2
answers
1k
views
IDA python, get address range of specific dll
I have the following IDA Python script. It is intended to break on first instruction of imported function when call comes from the module of interest:
list = []
def set_cb(ea, name, ord):
global ...
- 31
0
votes
1
answer
617
views
OllyDbg can't set permanent breakpoint
I am relatively new to the world of RE.
So, I am playing with a program, which relies on multiple dlls.
I am using 32 bit OllyDbg 2.01, and can’t put permanent breakpoints in one dll, others are fine, ...
- 3
5
votes
2
answers
4k
views
IDA Pro list COM methods
I have a dll file, containing some exported functions and COM methods.
Here is my dll information opened by DLL Export Viewer:
But when i open the dll file in ida pro, i see just exported functions ...
- 51
1
vote
2
answers
262
views
MSDetour not detouring SHGetKnownFolderPath
Tried to hook SHGetKnownFolderPath from shell32, using the normal DetourFunctionWithTrampoline, and it could not.
Investigating, it seen that the application use GetProcAddress to load the function, ...
- 263
2
votes
2
answers
6k
views
How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?
I know that the specifications of the Microsoft PE/DLL/DOS-MZ files states that the two first bytes of a PE/DLL/DOS-MZ file is MZ (0x4d,0x5a) orZM(0x5a,0x4d`).
The problem with such a small signature ...
- 18.6k
1
vote
2
answers
420
views
how to get hanging instructions of a dll using IDApython
I need to get hanging instructions i.e instructions which are not under any functions in a dll through idapython script? it is available in brown color when seen through IDA pro.
- 11
2
votes
1
answer
2k
views
Segments start address is different in IDApython when invoked thrg cmd prompt
I am able to get Segments start address, end address and all functions of a DLL through follwoing ida python script:
# Get the segment's starting address
ea = ScreenEA()
print(ea)
print(...
- 41
4
votes
1
answer
286
views
Wierd names in import table
I'm trying to do a static analysis of a PE file to see what it does.
While doing so, I stumbled upon some really wierd function names in my objdump
DLL Name: msvcrt.dll
vma: Hint/Ord Member-Name ...
- 153
1
vote
0
answers
42
views
Field that is never assigned? [closed]
I am reversing a DLL insied a Unity game with .NET Reflector, and I found some weird fields.
They are never assinged, there was no item under the Assigned by while there were some items under the Used ...
- 165
2
votes
1
answer
3k
views
Where can be assembly-csharp.dll decrypted?
So I have an android game. Its Assembly-CSharp.dll causes .NET Reflector to show
File is not a portable executable. DOS header does not contain 'MZ'
signature
It's encrypted. The app seems to ...
- 165
0
votes
1
answer
5k
views
Issue decompiling c# method
I'm trying to decompile a c# dll and on a particular method I'm getting this result
public IEnumerable<Guid> GetDbIdentifiers(int classId)
{
switch ((794999935 == 794999935) ? 1 : 0)
{
...
- 101
2
votes
1
answer
431
views
Question of analysing function of DLL and write program to call it [closed]
I have a customized DLL in a large software. The DLL compress/decompress image files. I need to use the DLL separately to get my important images back to decompressed version.
I can see its function ...
- 21
1
vote
0
answers
743
views
Reverse Engineering a whole project desktop application
Friends: i am trying to reverse engineer a CMS desktop application with the objective to make another with better functionallity; that CMS application contains 32 Dll´s; the idea is instead of create ...
- 29
3
votes
1
answer
2k
views
How to intercept a call to function with known name from known DLL
First of all I wasn't very much into reversing until now, so excuse me if my question is dumb.
I have a windows DLL most likely made with Visual C++. It's been developed in 1998 and has Mfc42.dll (4....
- 131
1
vote
0
answers
551
views
Get DLL from EXE file [duplicate]
I am trying to reverse engineer an DLL that is loaded from a EXE.
I don't have the DLL file. I just have an executable file that injects the DLL into a certain process.
When I try using ollydbg or ...
- 11
0
votes
2
answers
2k
views
Editing a string in a native dll
Can anyone help me edit a string in a native dll?
When I try to open the dll in CFF explorer or other similar tools, I can't see the string table, probably because it's hidden somehow.
The DLL in ...
- 11
4
votes
1
answer
3k
views
IDA Pro 64 bit disassembly error for system DLLs
I use IDA Pro 6.8.150428 (idaq64.exe) to disassemble system dlls (64 bit) e.g. ntdll.dll, kernel32.dll, etc. in Windows 10 64 bit. I found idaq64.exe correctly disassembling 64 bit sample applications ...
- 97
3
votes
1
answer
576
views
Do all drivers exist in Kernel mode?
I'm in the process of learning the Windows API and reversing in general, so I apologize if this is a fairly dumb question.
After reading a section of 'Practical Malware Analysis' discussing the ...
user15338
1
vote
0
answers
589
views
Android shared Library (.so)
I quite quite new to reverse engineering in General and there are a couple of things I'm unsure of. The app I am reverse engineering uses a couple of android libs in order to sign requests. So far I'...
- 31
3
votes
1
answer
2k
views
Why is this _DllMainCRTStartup calling convention not as expected?
I've been looking around at various DLLs on my computer lately and I thought a decent place to start was the image entry point (typically _DllMainCRTStartup).
From what I can see of the CRT source ...
- 31
0
votes
3
answers
444
views
Hex-Rays decompiles array to int
I decompiled one dll using Hex-Ray but it decompiled array type input argument of dll to int. Any idea how to handle this ??
double dzSell(int a1, double a2, int a3, int a4, int a5)
int a1 is array ...
0
votes
1
answer
168
views
Get DLL name with PyDBG and System_dll.py?
Is it possible to get the name and path of a DLL that is loaded by the application using PyDBG and System_dll.py? I have a script and PyDBG handles loaded dlls with just:
dbg.set_callback(...
- 345
2
votes
2
answers
309
views
Stepping through a program to figure out what subroutines are being called?
I've loaded a program into IDA + Hex-Rays, and decompiled it down to some C-like pseudo-code. Now, I am trying to figure out, for a single action that I am taking in the program, what code is being ...
- 123
3
votes
0
answers
245
views
Implementing call into compiled, undocumented, C DLL; divining exported function prototype
I've been attempting to build my own implementation of Nvidia's Surround functionality by using their DLLs within a more reliable and automatic system. I'm pretty new to this; I've been a programmer ...
- 131
3
votes
2
answers
9k
views
Where can I find the 64-bit version of shell32.dll on Windows?
I'm trying to debug Control Panel and I'd like to disassemble shell32.dll. Because control panel is a 64-bit executable, it loads the 64-bit version of the dll (contrary to the name). When I view the ...
1
vote
1
answer
2k
views
Decompiling a windows 3.1, VisualBasic 3 exe. Do I need to decompile dll too? How?
New to decompiling, and code generally. Trying to decompile a windows 3.1 game (text adventure), so I can build it up again. Because at the moment it doesn't work (even on windows 3.1).
I decompiled ...
- 111
5
votes
1
answer
12k
views
How to reverse a dll and call its functions?
I have got a custom.dll which is utilized in a larger application. The application executable imports this dll to use its functionality. But this functionality is not used through out the life cycle ...
- 619
2
votes
3
answers
1k
views
How to make a valid patch to bypass self checking security measure?
I have got a DLL file that I want to modify. Each time the executable file which imports the DLL is executed it performs a self checking process to find out whether the file is valid or not. How can I ...
- 619
1
vote
1
answer
356
views
How can I find the implementation/source code of an interface in .NET?
So I'm disassembling the Winnov.Amalga.Core.Session.Common.dll, and trying to figure out how the WriteScriptCommand works.
I'm absolutely new to .NET, so go easy on me, please.
You can find the dll ...
- 13
1
vote
1
answer
966
views
How to change the DLL name in the already compiled application?
I am trying to change the name of the DLL file I had specified for my application before compiling it. When I change the DLL file name I get the error message like:
System.IO.FileNotFoundException: ...
- 619
0
votes
1
answer
390
views
Some help with disassembled code understanding
I've got some windows dll file. This dll-file exports a couple of functions to read HDD with some unknown (to me) filesystem. So, I've launched IDA disassembler and started an investigation on how ...
- 103