Hot answers tagged

25 votes
Accepted

What kind of code would produce this assemby with loads of jump statements?

This looks like the output of Visual C++ linker in incremental linking mode. In this mode, the linker adds a section with incremental linking thunks (ILTs) at the start of the code section (.text), ...
Igor Skochinsky's user avatar
  • 36.4k
14 votes

Is there any way to decompile a .NET assembly or program?

Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code https://github.com/0xd4d/dnSpy Main difference from ...
Kalibr's user avatar
  • 159
11 votes
Accepted

Why can C# applications be reverse-compiled with variable names while C++ ones can't?

Debug Symbol information is often "stripped off" from C++ binaries. Symbol information stores all user-created names, symbols, and types, bounds, fouction boundary and other function related ...
R4444's user avatar
  • 1,797
9 votes
Accepted

Do all drivers exist in Kernel mode?

Would this driver exist in user space, or in kernel space? Kernel space. Is it even possible for a non kernel mode driver to exist? You can write a user-mode driver using the User-Mode Driver ...
Jason Geffner's user avatar
9 votes

What kind of code would produce this assemby with loads of jump statements?

If they were all to external targets then it would be the stubs for external functions when dynamically loading dlls. This way you can limit the amount of pages that need updating when a new dll get ...
ratchet freak's user avatar
7 votes
Accepted

dnSpy - What do these symbols mean?

These are Unicode characters that are not supported by the font used by dnSpy. Usually, you'll see it when the code is obfuscated or in cases where the developer used languages as Chinese and Russian ...
Megabeets's user avatar
  • 8,919
7 votes
Accepted

How can I access an internal DLL function or piece of data externally?

In case you know the address of your function in the DLL you can call in "C" language via a function pointer. Let us make an example: Assume you have a function residing in a DLL called "...
josh's user avatar
  • 1,964
6 votes

How to do Global DLL injection

TLDR: No, no and no. You have several questions hiding there in your post: Is is possible to inject a DLL into each and every process? If it is possible, can the following methods do that: ...
conio's user avatar
  • 632
6 votes
Accepted

Returning value from faux DLL

Your faux function is not fixing up the stack on the epilog of the function. It should have pop ds pop bp dec bp at the end by the calling convention. If you look at the original function it fixes ...
cimarron's user avatar
  • 1,331
5 votes

Why is this _DllMainCRTStartup calling convention not as expected?

With global optimisation (link-time code generation) the compiler is free to ignore the declared calling convention for all functions that aren't externally visible - that is, neither exported nor ...
DarthGizka's user avatar
  • 2,010
5 votes
Accepted

Wierd names in import table

As @guntram-blohm says, these are mangled C++ functions. If you demangle the names (using, for example, an online demangler) you will get the fully decorated function names: public: __thiscall ...
joxeankoret's user avatar
  • 4,480
5 votes
Accepted

Modifying Windows DLLs

Windows has a concept of trusted libraries to hamper attacks like these: Dynamic-Link Library Search Order Citing from the search order: If the DLL is on the list of known DLLs for the version of ...
Nordwald's user avatar
  • 2,896
5 votes
Accepted

Debug a .dll file within powershell

The file decrypter.dll is a .NET dll which (if it's not obfuscated) means you can decompile it to full readable source code with tools like Reflector, dotPeek or JustDecompile. Here are a couple of ...
Remko's user avatar
  • 3,208
5 votes

How to edit and modify a class with ILSpy + Reflexil

Try using dnSpy. It includes an ability to inject the recompiled code, and has the same interface as ILSpy. Use "Edit Method" option on the method you're editing, then "Build" and save the assembly. ...
Alien_AV's user avatar
  • 151
5 votes

Dumping dll out of process

I had written up a lengthy answer about some of the subtleties of dumping executables and DLLs before I realized that you may have simpler solutions available. Since you say it's downloading the DLL ...
Rolf Rolles's user avatar
  • 9,178
5 votes
Accepted

What is ObjectStublessClientXX in ole32dll?

COM is very abstract idea in Object Oriented Programming (OOP). To understand this well, you need some in-depth knowledge of Inheritance in OOP, Virtual Method Table, COM in separate process and Data ...
Biswapriyo's user avatar
  • 1,559
5 votes
Accepted

Get interface definition of undocumented COM objects

Now, this can't be a full-fledged answer from A to Z, unfortunately. But for COM there are only a few steps that are really specific to COM. The project you linked clearly has reverse-engineered the ...
0xC0000022L's user avatar
  • 10.9k
5 votes

Permanently load a DLL to an executable

An easy way to do this is to modify the IAT (Import Address Table/Import Directory) which can be done with a tool such as LordPE. From the main screen choose PE Editor and select the executable (or ...
Remko's user avatar
  • 3,208
4 votes

How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?

An old DOS EXE header is only 28 (0x1C) bytes long and is usually followed by the DOS relocation table if present. The IMAGE_DOS_HEADER struct of the NT PE header is much larger at 64 (0x40) bytes as ...
byteptr's user avatar
  • 141
4 votes

IDA Pro list COM methods

Original question This is not as trivial as one would hope for quite a simple reason, COM objects are internal objects, and do not expose their implementation details by exporting functions. Instead, ...
NirIzr's user avatar
  • 11.7k
4 votes
Accepted

Solving method of DLL crackme

Once you have patched the malformed bytes to make the patched DLL proper, you can use something like this to call the GetFlag function. #include <Windows.h> typedef DWORD (__cdecl *_GetFlag)();...
sudhackar's user avatar
  • 2,629
4 votes
Accepted

Decompile a DLL file from Microsoft Media Creation Tool

Disclaimer: The following links are for Fall Creators Update and may be change in future updates. Download the Media Creation Tool from Microsoft website. Open the executable in 7ZIP and extract all ...
Biswapriyo's user avatar
  • 1,559
4 votes

How can I access an internal DLL function or piece of data externally?

The GetProcAddr Windows API is used to retrieve addresses for exported functions. It will always return null for non-exported functions as it is unable to find it in the PE file. Exporting a function ...
NirIzr's user avatar
  • 11.7k
4 votes

Comparison between orginal and modified DLL files with x64dbg

You shouldn't use a debugger to search for differences. You should use a diff tool. Of course, most diff tools work on ASCII text, but there are some that deal with binary files. Some examples: ...
Paweł Łukasik's user avatar
4 votes

Syscall from ntdll.dll

int 2e was used in systems prior to windows xp from windows xp fast syscall is the preferred method to transition from usermode to kernel mode fast syscall pointer is embedded in the the Shared User ...
blabb's user avatar
  • 16.3k
4 votes

What is the difference between kernelBase.dll and Kernel32.dll

I think this is the reason why there are some WinAPIs that also existing in kernelbase.dll. "As an example of functionality that we moved to low-level binaries, kernelbase.dll gets functionality ...
ismael_akez's user avatar
4 votes
Accepted

Ghidra can't Decompile kernelbase.dll exported functions?

Try to do ctrl + A - select all and then press D to disassemble. good chance it will solve your problem.
macro_controller's user avatar
4 votes
Accepted

Function Prologue, add esp directive

The large integer that is added to ESP is negative and is used to move the stack pointer to a an address that allows 0x44 bytes on the stack for the current function. At this point, ESP=EBP-0x44. So, ...
Yotamz's user avatar
  • 912
4 votes
Accepted

How to hook to a system function

Two possibilities: Patch the call instruction to point to a destination of your choosing, such as a "code cave" between the end of the .text section and the subsequent section. Write your ...
Rolf Rolles's user avatar
  • 9,178

Only top scored, non community-wiki answers of a minimum length are eligible