Hot answers tagged

4

The large integer that is added to ESP is negative and is used to move the stack pointer to a an address that allows 0x44 bytes on the stack for the current function. At this point, ESP=EBP-0x44. So, EBP-0x44 is essentially, [ESP]. It is equivalent to PUSH EAX, as a parameter for the CALL that comes next. The ss: is a selector which indicates that the "...


3

using windbg you can set an sxe ld:Modname event break assuming you are running this which will pop up a help gui for printers rundll32.exe printui.dll PrintUIEntry /? if you want to Break on this printUI.dll's CrtMain or AddressOfEntryPoint you can do it like this C:\WINDOWS\system32>cdb rundll32.exe printui.dll PrintUIEntry /? Microsoft (R) ...


3

Try to do ctrl + A - select all and then press D to disassemble. good chance it will solve your problem.


2

First, please read this. Essentially the difference is (in both cases) that one - the entry point - refers to the address where the initial code will be located and the other - "main function" - will be the one provided by the (C) runtime, potentially hiding gory details from you. From what I understand, Start is the entry point for an exe and it does ...


2

It is possible that the program is employing mittigations against DLL sideloading and won't load the DLL from current directory. Check Secure loading of libraries to prevent DLL preloading attacks. You can check what paths the program is actually trying to use with Process Monitor (see Using Process Monitor to dynamically detect nonsecure loads in the ...


1

The DLL base address is the address of the IMAGE_DOS_HEADER struct. If you don't find 'MZ' at the DLL base address, you probably have the wrong address.


1

This problem is not unique to call eax but potentially any indirect call or a call to a function with wrong type information. The possible causes and solutions are described in the Hex-Rays Decompiler manual. One common cause is the stack adjustment of the call not being correctly detected by IDA (e.g. the called function is stdcall with arguments but IDA ...


1

You can take one of the following approaches: call eax usually means there is an indirect call. try to find what and where eax is defined. Maybe only by looking at it, you will found the problem. If you find the origin but not understand the problem, you can try to patch it, to something like: mov eax, <known_function_address> Maybe you can change a ...


1

You can't load 32bit Dlls in 64bit Processes Solution: build a 32bit App or write an external 32bit prozess(yes a EXE) that loads the DLL and communication with that process using Pipes or TCP/IP from your 64bit app btw: the first Dlls name is FileAnalyzer.dll, in the Code is FileDataCtrl.dll?


1

there is a way more easy solutuion: use Microsoft Detours: https://github.com/microsoft/Detours very well developed, works out of the box, easy compileable on VStudio shell with nmake (just follow the build instructions), many small examples can detours some (or all) of the Dll-Functions to your own code without replacing the original Dll or patching the ...


1

you should normally take a pencil and paper and try solving it ill use python here >>> ebp = 0x1000 >>> esp = ebp >>> esp = ( esp + 0xffffffbc )& 0xffffffff >>> print(hex(esp),hex(ebp-0x44)) 0xfbc 0xfbc >>> It will write 0 to the Address 0xfbc if ebp were 0x1000 to start with


1

These are functions exported by ordinal rather than by name. This being a C++ library the actual (mangled) function names are long (up to 200 characters with an average of over 50.) Dynamic linking using names in this case would involve lots of long string comparisons that would slow down the loading of applications using this library. 6153 ?...


1

I wrote the code for WSPE.dat and can confirm that I custom wrote the encryption based on the supplied name/key plus the 'invalid' PE heading. So, if a user attempts to modify the PE heading on the drive to allow for debugging of the DLL for a dump then it'll fail to properly decrypt in memory.


1

The easiest way would be just to set a breakpoint where the call instruction is and then perform step into - you will be redirected to the right function. You can also check it statically assuming that you know where the GameLauncher_StartGameW is called. Notice that just before call [eax+8], eax contains *arg0 value. If you know the arguments' values, you ...


1

Nexide, wild guess but your game is complied with il2cpp. You could use Scylla to dump GameAssembly.DLL and you'll get a dumb folder and with that you use Il2cppDumper, drag both the Globalmeta.dat file and the GameAssembly.dll-Dumped file inside where all the il2cppdumper dlls are stored, then run Il2cppdumper then press GameAssembly.dll then Globalmeta ...


Only top voted, non community-wiki answers of a minimum length are eligible