26
votes
Accepted
How to debug the DLL of an EXE using IDA Pro?
Very easy, if I got you right:
Make an Ida project from the DLL, i.e. drag and drop the dll into the blank Ida page.
In Menu Debugger, Process Options, put the path to your exe into the textbox "...
- 1,814
25
votes
Accepted
What kind of code would produce this assemby with loads of jump statements?
This looks like the output of Visual C++ linker in incremental linking mode. In this mode, the linker adds a section with incremental linking thunks (ILTs) at the start of the code section (.text), ...
- 35.1k
14
votes
Is there any way to decompile a .NET assembly or program?
Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code
https://github.com/0xd4d/dnSpy
Main difference from ...
- 159
11
votes
Accepted
Why can C# applications be reverse-compiled with variable names while C++ ones can't?
Debug Symbol information is often "stripped off" from C++ binaries. Symbol information stores all user-created names, symbols, and types, bounds, fouction boundary and other function related ...
- 1,487
9
votes
Accepted
Do all drivers exist in Kernel mode?
Would this driver exist in user space, or in kernel space?
Kernel space.
Is it even possible for a non kernel mode driver to exist?
You can write a user-mode driver using the User-Mode Driver ...
- 20.5k
9
votes
What kind of code would produce this assemby with loads of jump statements?
If they were all to external targets then it would be the stubs for external functions when dynamically loading dlls.
This way you can limit the amount of pages that need updating when a new dll get ...
- 582
7
votes
Accepted
dnSpy - What do these symbols mean?
These are Unicode characters that are not supported by the font used by dnSpy.
Usually, you'll see it when the code is obfuscated or in cases where the developer used languages as Chinese and Russian ...
- 8,689
6
votes
Accepted
DLL Injection search for procedures/variables
If you want to use a function in the application the bottom line is that you need to know where it's located. Without ASLR you can hardcode the address of the function into your DLL, and use a ...
- 211
6
votes
How to reverse a dll and call its functions?
You can use OllyDbg's loaddll.exe to load a DLL and call (and debug) its functions:
- 20.5k
6
votes
How to do Global DLL injection
TLDR: No, no and no.
You have several questions hiding there in your post:
Is is possible to inject a DLL into each and every process?
If it is possible, can the following methods do that:
...
- 632
6
votes
Accepted
Returning value from faux DLL
Your faux function is not fixing up the stack on the epilog of the function. It should have
pop ds
pop bp
dec bp
at the end by the calling convention.
If you look at the original function it fixes ...
- 1,331
6
votes
Accepted
How can I access an internal DLL function or piece of data externally?
In case you know the address of your function in the DLL you can call in "C" language via a function pointer. Let us make an example:
Assume you have a function residing in a DLL called "...
- 1,814
5
votes
Why is this _DllMainCRTStartup calling convention not as expected?
With global optimisation (link-time code generation) the compiler is free to ignore the declared calling convention for all functions that aren't externally visible - that is, neither exported nor ...
- 1,960
5
votes
Accepted
Wierd names in import table
As @guntram-blohm says, these are mangled C++ functions. If you demangle the names (using, for example, an online demangler) you will get the fully decorated function names:
public: __thiscall ...
- 4,325
5
votes
Accepted
Modifying Windows DLLs
Windows has a concept of trusted libraries to hamper attacks like these:
Dynamic-Link Library Search Order
Citing from the search order:
If the DLL is on the list of known DLLs for the version of ...
- 2,836
5
votes
Accepted
Debug a .dll file within powershell
The file decrypter.dll is a .NET dll which (if it's not obfuscated) means you can decompile it to full readable source code with tools like Reflector, dotPeek or JustDecompile.
Here are a couple of ...
- 3,003
5
votes
How to edit and modify a class with ILSpy + Reflexil
Try using dnSpy. It includes an ability to inject the recompiled code, and has the same interface as ILSpy. Use "Edit Method" option on the method you're editing, then "Build" and save the assembly. ...
- 151
5
votes
Dumping dll out of process
I had written up a lengthy answer about some of the subtleties of dumping executables and DLLs before I realized that you may have simpler solutions available. Since you say it's downloading the DLL ...
- 8,004
5
votes
Accepted
What is ObjectStublessClientXX in ole32dll?
COM is very abstract idea in Object Oriented Programming (OOP). To understand this well, you need some in-depth knowledge of Inheritance in OOP, Virtual Method Table, COM in separate process and Data ...
- 1,489
5
votes
Permanently load a DLL to an executable
An easy way to do this is to modify the IAT (Import Address Table/Import Directory) which can be done with a tool such as LordPE.
From the main screen choose PE Editor and select the executable (or ...
- 3,003
4
votes
Accepted
How to analyse a poorly documented DLL API?
My first recommendation would be to contact the vendor and ask them your questions. You paid for the product and its SDK, so if the latter is not usable, they should offer support to you.
As for ...
- 20.5k
4
votes
Accepted
How to hook the entry point of a DLL?
To answer the original question, what you can do is to hook LdrpCallInitRoutine in ntdll.dll. This function is used by DLL loading/unloading code to actually call the DLL entry point (DllMain) and ...
- 35.1k
4
votes
Using a DLL proxy fails due to an unknown error
The problem happens due to the fact that the required CRT DLL's are missing on the target machine. To avoid this you can link against the CRT statically.
Use the Multi-threaded (/MT) linker flags in ...
- 5,890
4
votes
Find exact dependency tree of a program
You can use the following tools to inspect and try to recover information about PE file:
PEiD it has extensive pe file editing capabilities
Detect It Easy - another very useful tool for PE analysis
...
- 2,862
4
votes
How to quickly distinguish PE/DLL/DOS-MZ files based on magic numbers?
An old DOS EXE header is only 28 (0x1C) bytes long and is usually followed by the DOS relocation table if present. The IMAGE_DOS_HEADER struct of the NT PE header is much larger at 64 (0x40) bytes as ...
- 141
4
votes
IDA Pro list COM methods
Original question
This is not as trivial as one would hope for quite a simple reason, COM objects are internal objects, and do not expose their implementation details by exporting functions.
Instead, ...
- 11.4k
4
votes
Accepted
Solving method of DLL crackme
Once you have patched the malformed bytes to make the patched DLL proper, you can use something like this to call the GetFlag function.
#include <Windows.h>
typedef DWORD (__cdecl *_GetFlag)();...
- 2,399
4
votes
Accepted
Decompile a DLL file from Microsoft Media Creation Tool
Disclaimer: The following links are for Fall Creators Update and may be change in future updates.
Download the Media Creation Tool from Microsoft website. Open the executable in 7ZIP and extract all ...
- 1,489
4
votes
How can I access an internal DLL function or piece of data externally?
The GetProcAddr Windows API is used to retrieve addresses for exported functions. It will always return null for non-exported functions as it is unable to find it in the PE file.
Exporting a function ...
- 11.4k
4
votes
Syscall from ntdll.dll
int 2e was used in systems prior to windows xp
from windows xp fast syscall is the preferred method to transition from usermode to kernel mode
fast syscall pointer is embedded in the the Shared User ...
- 15.2k
Only top scored, non community-wiki answers of a minimum length are eligible