How to disassemble a .dll

Discussion in 'Archives' started by Lobe, Jun 26, 2008.

How to disassemble a .dll
  1. Unread #1 - Jun 26, 2008 at 10:14 AM
  2. Lobe
    Referrals:
    0

    Lobe Guest

    How to disassemble a .dll

    Ever wanted to know what was inside a .dll file without using a hex viewer?
    This tutorial will tell you how to, and includes some examples.

    OK. So, first you need some tools for the job.
    1. IDA pro Freeware, or another disassembler.
    Get IDA pro freeware here: http://www.hex-rays.com/idapro/idadown.htm (Its free!)
    2. A .dll
    3. A fairly good PC

    First, open up IDA pro. Then click 'new' when the window opens of recently opened files. After it loads, find the .dll you want to open, and click ok until it starts (Don't change any settings).

    When it is finished, you can browse the code. This is NOT the C/C++ code that was used to compile the .dll. It is the code that actually runs on the computer (What is inside the .dll).
    An example of some code:
    Code:
       mov     [esp+438h+var_408], 9
    .text:2233D90C                 mov     [esp+438h+var_40C], ecx
    .text:2233D910                 call    sub_2233D080
    .text:2233D915                 mov     eax, [esp+438h+var_4]
    .text:2233D91C                 add     esp, 10h
    .text:2233D91F                 test    eax, eax
    .text:2233D921                 jnz     short loc_2233D92E
    .text:2233D923                 pop     ebp
    
    While this is quite useless unless you are using a method known as SigScanning to hook functions, it is interesting to see what really goes on behind the scenes in your computer.
     
< HowTo download music using Python | Death To The Doggershan Creat >

Users viewing this thread
1 guest


 
 
Adblock breaks this site