Hot answers tagged

25

This looks like the output of Visual C++ linker in incremental linking mode. In this mode, the linker adds a section with incremental linking thunks (ILTs) at the start of the code section (.text), each thunk being a relative jump (E9 xx xx xx xx) to a function. All function calls in the binary are redirected to the corresponding ILT instead of pointing ...


22

Very easy, if I got you right: Make an Ida project from the DLL, i.e. drag and drop the dll into the blank Ida page. In Menu Debugger, Process Options, put the path to your exe into the textbox "Application", Into "input file" put the path to your DLL. Confirm with OK. Start with menu Debugger, Start Process or F9. Your breakpoint should be hit.


14

Recently I've been using dnSpy [forked from ILSpy by the creator(s) of de4dot] as my main tool for the decompiling and live debugging of .NET code https://github.com/0xd4d/dnSpy Main difference from ILSpy : Uses dnLib to read assemblies (vs ILSpy's Mono.Cecil) https://github.com/0xd4d/dnlib dnlib was created because de4dot needed a robust .NET ...


11

I think you have 4 options here: Overwrite the function in assembler using OllyDbg, IDA Pro or any other tool. However, you may not have enough space. Insert a jmp to another place where you have enough space to do this. You will likely need to find for "holes" between sections where you can put your code. Add a new section to the PE/ELF file, mark it as ...


11

Debug Symbol information is often "stripped off" from C++ binaries. Symbol information stores all user-created names, symbols, and types, bounds, fouction boundary and other function related metadata information (it is generally stored according to a popular and standardized "dwarf" format which is widely used and employed in modern ...


9

One thing you need to keep in mind is that code in your process and the code in the target process reside in different address spaces. So any address in your program is not necessary valid in the target process and vice versa. This means the code that you inject cannot make any assumptions about addresses of functions or variables. Even your inject function'...


9

Would this driver exist in user space, or in kernel space? Kernel space. Is it even possible for a non kernel mode driver to exist? You can write a user-mode driver using the User-Mode Driver Framework, but that type of driver is effectively a user-mode service with access to some extra I/O functionality. What we typically think of as a "driver" is a ...


9

If they were all to external targets then it would be the stubs for external functions when dynamically loading dlls. This way you can limit the amount of pages that need updating when a new dll get loaded. Which lets the calling code be position independent with regards to the call target. Calls to external function are sent to that page and forwarded to ...


8

The surprising part for me is objdump can recognize anything in a PE file. According to Wikipedia, .. PE is a modified version of the Unix COFF file format. PE/COFF is an alternative term in Windows development. so apparently there is just enough overlap in the headers to make it work (at least partially). The basic design of one is clearly based on the ...


7

Question 1: What is causing these bytes to change? These appear to be standard relocation fixups applied based on the DLL's Relocation Table. Sub-question 1.1: Is is some sort of protection mechanism? No. Sub-question 1.2: Was it recently introduced? No. Sub-question 1.3: Can it be disabled? Not easily, no. Question 2: What do these changing ...


7

These are Unicode characters that are not supported by the font used by dnSpy. Usually, you'll see it when the code is obfuscated or in cases where the developer used languages as Chinese and Russian in their code. But yeah, usually obfuscation. You can try to deobfuscate this .Net binary by using de4dot which is doing an incredible job with deobfuscating ...


6

First thing that comes to mind is the following approach Using your favourite debugger/disassembler locate the function and note down some unique byte pattern which identifies the function (Sort of like IDA's Flirt signatures) Get a handle to the DLL (GetModuleHandleA) Get the image size (from MODULEINFO.SizeOfImage using GetModuleInformation) Search for ...


6

If you want to use a function in the application the bottom line is that you need to know where it's located. Without ASLR you can hardcode the address of the function into your DLL, and use a function pointer to call it. If you want to modify data from a function in a loaded library then you would need to hook that function, and call your own code for its ...


6

You can use OllyDbg's loaddll.exe to load a DLL and call (and debug) its functions:


6

TLDR: No, no and no. You have several questions hiding there in your post: Is is possible to inject a DLL into each and every process? If it is possible, can the following methods do that: SetWindowsHookEx? AppInit_Dlls? The answer to the first question is "no". The answer to both parts of the second question is "no, even if the answer to the first ...


6

Your faux function is not fixing up the stack on the epilog of the function. It should have pop ds pop bp dec bp at the end by the calling convention. If you look at the original function it fixes up the stack correctly. Let's say the stack pointer had the value of 1000h coming into the function (after CS:IP is already pushed on the stack for the far ...


6

In case you know the address of your function in the DLL you can call in "C" language via a function pointer. Let us make an example: Assume you have a function residing in a DLL called "notExportedFunc" with the signature int notExportedFunc(int a, int b); You could call it like in the following main program: typedef int notExportedFunc(int a, int b); ...


5

The problem you face is quite common. A .NET application still loads many native DLLs. Most surprising for many people is that the .NET framework itself is native. You can identify .NET DLLs in WinDbg using the lm v command. In case of a managed DLL it says: 0:008> lmv m MyApp start end module name 10310000 10574000 MyApp(deferred) ...


5

It's not very reliable. IDA can't determine types beyond analyzing the size and type of loads and stores. For instance IDA doesn't tell the difference between a pointer to a type and an integer, given that they're the same size, as far as I know. Other than that all it can do is propagate type information entered by the user. I believe the Hex-Rays ...


5

With global optimisation (link-time code generation) the compiler is free to ignore the declared calling convention for all functions that aren't externally visible - that is, neither exported nor otherwise pinned by having their addresses taken and passed to external code. This can make the resulting binaries difficult to analyse since even the well-known ...


5

As @guntram-blohm says, these are mangled C++ functions. If you demangle the names (using, for example, an online demangler) you will get the fully decorated function names: public: __thiscall bad_cast::bad_cast(class bad_cast const &) public: virtual __thiscall bad_cast::~bad_cast(void) So these functions are the constructor and the destructor for ...


5

I had written up a lengthy answer about some of the subtleties of dumping executables and DLLs before I realized that you may have simpler solutions available. Since you say it's downloading the DLL off of the network, perhaps you can just read the raw contents of the DLL from the network traffic? If the traffic, and the DLL, are unencrypted, this should be ...


5

COM is very abstract idea in Object Oriented Programming (OOP). To understand this well, you need some in-depth knowledge of Inheritance in OOP, Virtual Method Table, COM in separate process and Data Marshaling with COM. Those subroutines are part of a COM Proxy/Stub DLL. Proxy DLL are used when the COM interfaces are defined/implemented in separate DLL ...


5

An easy way to do this is to modify the IAT (Import Address Table/Import Directory) which can be done with a tool such as LordPE. From the main screen choose PE Editor and select the executable (or DLL) that you wish to modify: Then click Directories: Click the Ellipsis button next to Import Table: Right Click and choose add import: Now add your dll and ...


4

In addition to peter ferries answer, some python code to check for the same: import sys def unpack(byte): return sum([ ord(b) << (8 * i) for i, b in enumerate(byte) ]) if len(sys.argv) == 1: print >> sys.stderr, "No input file given!" else: myfile = sys.argv[1] with open(myfile, "r") as f: f.seek(0x3c) ...


4

I'll list some ways to do it. Obviously there are many others and most likely other fellows here will add. Start with those as they are ones of the mostly used. While debugging a malicious process, BP on WriteProcessMemory/NtMapViewOfSection API. Those are used to copy/map potential DLL into the remote process. Before the copying or mapping is done, you can ...


4

Based on this answer, rundll only supports running functions with a specific signature. I would recommend writing a simple executable that loads it. For example, in c, you could call LoadLibrary("yourdll.dll") and then GetProcAddress("yourfunc") and then call it that way. See MSDN (linked) for more info. In IDA, you would then give your executable as the ...


4

To answer the original question, what you can do is to hook LdrpCallInitRoutine in ntdll.dll. This function is used by DLL loading/unloading code to actually call the DLL entry point (DllMain) and also the TLS callbacks. The first argument is the address to be called: BOOLEAN NTAPI LdrpCallInitRoutine(PDLL_INIT_ROUTINE EntryPoint, PVOID BaseAddress, ULONG ...


4

The problem happens due to the fact that the required CRT DLL's are missing on the target machine. To avoid this you can link against the CRT statically. Use the Multi-threaded (/MT) linker flags in VS. This way you also do not need to install VCRedist on target computer. More info here Another way is to install Dependency Walker on the target machine, ...


4

You can use the following tools to inspect and try to recover information about PE file: PEiD it has extensive pe file editing capabilities Detect It Easy - another very useful tool for PE analysis Viewing import table from windbg - if the above will not be very helpful, you can always use the debugger. Dumbin - Microsoft utility to inspect PE file, among ...


Only top voted, non community-wiki answers of a minimum length are eligible