New answers tagged

0

Hook loadlibrary and see what it gets called with, this will pick up ntdll loading as well as anything done manually by the app. If you're using x64dbg you can make the breakpoint log out each call and then just look at the logs after it crashes out


0

Sometimes creating a file file.exe.local next to file.exe is enough to make it load DLLs from the same directory but it may not work if the program applied DLL sideloading mitigations or loads the DLL manually from the system directory using absolute path.


Top 50 recent answers are included