Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Code code:"if (foo != bar)"
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Bookmarks inbookmarks:mine
inbookmarks:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with
Search options user 2021

Dynamic-link library, or DLL, is Microsoft's implementation of the shared library concept in the Microsoft Windows and OS/2 operating systems.

1
vote
You'll make 2 assumptions: all virtual memory allocations are done with 4k (0x1000) incremental .text section will (in most cases) be places after the PE header So, your goal would be to find the …
answered Jul 7 '17 by PhoeniX
4
votes
You can use the following tools to inspect and try to recover information about PE file: PEiD it has extensive pe file editing capabilities Detect It Easy - another very useful tool for PE analysis …
answered Jan 5 '15 by PhoeniX
1
vote
Your question is too broad and it looks that you lack basics in the RCE in general. I would suggest to start with some theory : Reversing: Secrets of Reverse Engineering - nice book for an intro Col …
answered Jan 6 '15 by PhoeniX
5
votes
Patching game's executable + using loading order trick You should check the integrity of the games executable files before loading as there are way to patch it to load malicious Dll files, overlays if … Process Injection - it does not have to be dll but some arbitrary code Monitor "invasion" API calls (for example) by patching a. WriteProcessMemory b. VirtualAlloc(Ex) c. VirtualProtect d. …
answered Jun 16 '13 by PhoeniX
12
votes
DllMain - is the default function name that is given during DLL development and it is how the compiler knows that it should take the address of this function and put it inside PE AddressOfEntryPoint field …
answered May 22 '13 by PhoeniX
4
votes
Those are used to copy/map potential DLL into the remote process. Before the copying or mapping is done, you can dump the buffer to disk. … Once you see something in the log that is 100% done by the mal-DLL, you can open that log line and inspect the stack. The stack will tell you at what page the mal-DLL resides. …
answered Jan 1 '14 by PhoeniX