Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options user 1562

Dynamic-link library, or DLL, is Microsoft's implementation of the shared library concept in the Microsoft Windows and OS/2 operating systems.

3
votes
either, which is why both fields are NULL in the Export Directory Table. In fact, shell32.dll calls one of the functions in profapi.dll using its ordinal number and the linker somehow resolves … the address. The build-time linker (part of the compiler toolkit) doesn't resolve the address; the run-time loader (part of Windows) resolves the address. The loader see that shell32.dll imports a …
answered Nov 18 '14 by Jason Geffner
3
votes
As @peter-ferrie said, 32-bit processes will use C:\WINDOWS\SysWOW64\shell32.dll instead of C:\WINDOWS\system32\shell32.dll if you specify C:\WINDOWS\system32\shell32.dll. To force a 32-bit process … to use the actual 64-bit version, you can specify the following file path: C:\WINDOWS\Sysnative\shell32.dll This saves you the trouble of having to use Explorer to make a copy of the 64-bit DLL. …
answered Nov 2 '15 by Jason Geffner
2
votes
When you open a DLL file with IDA, if IDA is able to find the DllMain() function then it will automatically navigate to that function when you first disassemble the DLL. Note that the DLL's entry …
answered May 26 '15 by Jason Geffner
2
votes
profapi.dll should certainly have an Export Table. For example, here's the Export Table from profapi.dll version 6.3.9600.16384: There is an export table in .text at 0x10001000 The Export Tables (in …
answered Nov 14 '14 by Jason Geffner
7
votes
Question 1: What is causing these bytes to change? These appear to be standard relocation fixups applied based on the DLL's Relocation Table. Sub-question 1.1: Is is some sort of protection m …
answered Mar 18 '14 by Jason Geffner
2
votes
Is it possible the ZIP/UNZIP calls are modifying the password Yes, it's possible that <Module>.addUNZIP_Decrypt() modifies the password, or draws a giraffe on your screen, or plays The Star Spang …
answered Mar 15 '15 by Jason Geffner
9
votes
Would this driver exist in user space, or in kernel space? Kernel space. Is it even possible for a non kernel mode driver to exist? You can write a user-mode driver using the User-Mode Driv …
answered Mar 9 '16 by Jason Geffner
0
votes
If you look at the decompiled code for the Winnov.Amalga.Core.Client constructor, you'll see that this._Session is a web service interface to whatever web service was used when constructing Winnov.Ama …
answered Jul 24 '15 by Jason Geffner
1
vote
http://www.motobit.com/util/base64-decoder-encoder.asp Choose decode the data from a Base64 string and export to a binary file.
answered Mar 19 '15 by Jason Geffner
4
votes
monitoring DLL function calls, I'd recommend using API Monitor and its External DLL Filter functionality. It won't solve everything for you since you'd still need to figure out how many arguments are … expected for each DLL function (you can extract that information with IDA), but I think it'll get you 90% of the way there. …
answered Jun 10 '15 by Jason Geffner
6
votes
You can use OllyDbg's loaddll.exe to load a DLL and call (and debug) its functions: …
answered Aug 28 '15 by Jason Geffner
1
vote
The easiest solution would likely be to patch the first block of the function to be the following: push rbx sub rsp, 20h mov rax, 85857490416 mov rbx, rcx Though mov rax, 85857490416 …
answered Jul 16 '15 by Jason Geffner
2
votes
(GetProcAddress(GetModuleHandle("shell32.dll"), "SHGetKnownFolderPath"), Hook) to ensure that you're using the actual address of the exported API function. …
answered Jul 28 '16 by Jason Geffner
2
votes
At one particular instance it showed a debug error saying: "The process was not able to resume execution because the ESP value was changed", or something similar. ... typedef void(__cdecl …
answered Dec 20 '14 by Jason Geffner
1
vote
So, I assume I need to decompile this dll too. As Guntram said, no, you don't need to decompile the VBX files. So, it decompiled fine to mak, frm and bas files. I compiled the program again …
answered Oct 9 '15 by Jason Geffner

15 30 50 per page