View Single Post
  #6  
Old 05-31-2004, 09:28
sgdt
 
Posts: n/a
Without more information, here's a really easy fix. Works for me 99% of the time. No need for anything complex, just standard programming stuff.

Let's say your DLL is called DoBadThings.dll and you want to learn more about it, circumvent it, etc.

From a command prompt type:
dumpbin /EXPORTS DoBadThings.dll > DoBadThings.txt

In TextPad or simular editor, cut out all but the export entries, and in block mode, cut out the first 3 fields (Ordinal, hint, and RVA) leaving only the Names.

Rename "DoBadThings.txt" to "DoBadThings.def", and copy it to the files "DoBadThings.cpp" and "DoBadThings.h"

On the DEF file, insert the following two lines at the begining:

LIBRARY DoBadThings
EXPORTS

and then insert tabs infront of each of the names. You can now type:
lib /defoBadThings.def
to generate an import library.

On the H and CPP files, un-mangling if present (pretty easy, P means pointer, etc. google if you run into trouble) and create function stubs. For non-mangled names, use a Macro in Textpad to write out the Curely braces, etc.

If the caller program has savere encryption and antidebug, you can use OutputDebugString in the stub routines to grok calling sequence and parameters even if you have non-mangled names. Otherwise, it's shooting fish in a barrel. (look for push instructions, mov ecx, and add esp instructions to get calling convention and parameter counts).

Rename original "DoBadThings.dll" to "DoBadThings_Original.dll" and put in your own.

In your DLL, call "DoBadThings_Original.dll" as needed for snooping, or only call it sometimes, or don't even call it at all. Your choice.

Not rocket science. A little more work than "just deleting the DLL", but I think you'll find it a bit more usefull.
Reply With Quote