New answers tagged dll
2
using windbg you can set an sxe ld:Modname event break
assuming you are running this which will pop up a help gui for printers
rundll32.exe printui.dll PrintUIEntry /?
if you want to Break on this printUI.dll's CrtMain or AddressOfEntryPoint you can do it like this
C:\WINDOWS\system32>cdb rundll32.exe printui.dll PrintUIEntry /?
Microsoft (R) ...
0
Try this: https://github.com/hexfati/SharpDllLoader
A simple C# executable that invokes an arbitrary method of an arbitrary C# DLL. The project is useful to analyze malicious C# DLL through the popular tool DNSpy.
1
This problem is not unique to call eax but potentially any indirect call or a call to a function with wrong type information. The possible causes and solutions are described in the Hex-Rays Decompiler manual.
One common cause is the stack adjustment of the call not being correctly detected by IDA (e.g. the called function is stdcall with arguments but IDA ...
1
You can take one of the following approaches:
call eax usually means there is an indirect call. try to find what and where eax is defined. Maybe only by looking at it, you will found the problem. If you find the origin but not understand the problem, you can try to patch it, to something like: mov eax, <known_function_address>
Maybe you can change a ...
1
You can't load 32bit Dlls in 64bit Processes
Solution: build a 32bit App or write an external 32bit prozess(yes a EXE) that loads the DLL and communication with that process using Pipes or TCP/IP from your 64bit app
btw: the first Dlls name is FileAnalyzer.dll, in the Code is FileDataCtrl.dll?
1
there is a way more easy solutuion:
use Microsoft Detours: https://github.com/microsoft/Detours
very well developed, works out of the box, easy compileable on VStudio shell with nmake (just follow the build instructions), many small examples
can detours some (or all) of the Dll-Functions to your own code without replacing the original Dll or patching the ...
0
AFAIK, knowing what registry keys are used is not always enough, because the registry is just a place to store things like preferences. Setting a registry value may not have any immediate effect on a device. The real source of truth of how a device is configured is the device itself.
From my experience control panels tend to be lightweight GUIs hosted by ...
2
It is possible that the program is employing mittigations against DLL sideloading and won't load the DLL from current directory. Check Secure loading of libraries to prevent DLL preloading attacks.
You can check what paths the program is actually trying to use with Process Monitor (see Using Process Monitor to dynamically detect nonsecure loads in the ...
0
I know this is not a direct answer, but I cant comment with my amount of rep here.
Maybe the loading application is checking the DLL name, that is stored inside of the loaded DLL. There is a field somewhere in the header, that contains the name of the dll at compile time iirc.
It could be possible, that the dll is lazy loaded and the error message is just ...
Top 50 recent answers are included
