L
Lobe
Guest
Ever wanted to know what was inside a .dll file without using a hex viewer?
This tutorial will tell you how to, and includes some examples.
OK. So, first you need some tools for the job.
1. IDA pro Freeware, or another disassembler.
Get IDA pro freeware here: http://www.hex-rays.com/idapro/idadown.htm (Its free!)
2. A .dll
3. A fairly good PC
First, open up IDA pro. Then click 'new' when the window opens of recently opened files. After it loads, find the .dll you want to open, and click ok until it starts (Don't change any settings).
When it is finished, you can browse the code. This is NOT the C/C++ code that was used to compile the .dll. It is the code that actually runs on the computer (What is inside the .dll).
An example of some code:
While this is quite useless unless you are using a method known as SigScanning to hook functions, it is interesting to see what really goes on behind the scenes in your computer.
This tutorial will tell you how to, and includes some examples.
OK. So, first you need some tools for the job.
1. IDA pro Freeware, or another disassembler.
Get IDA pro freeware here: http://www.hex-rays.com/idapro/idadown.htm (Its free!)
2. A .dll
3. A fairly good PC
First, open up IDA pro. Then click 'new' when the window opens of recently opened files. After it loads, find the .dll you want to open, and click ok until it starts (Don't change any settings).
When it is finished, you can browse the code. This is NOT the C/C++ code that was used to compile the .dll. It is the code that actually runs on the computer (What is inside the .dll).
An example of some code:
Code:
mov [esp+438h+var_408], 9
.text:2233D90C mov [esp+438h+var_40C], ecx
.text:2233D910 call sub_2233D080
.text:2233D915 mov eax, [esp+438h+var_4]
.text:2233D91C add esp, 10h
.text:2233D91F test eax, eax
.text:2233D921 jnz short loc_2233D92E
.text:2233D923 pop ebpWhile this is quite useless unless you are using a method known as SigScanning to hook functions, it is interesting to see what really goes on behind the scenes in your computer.