TransWikia.com

Calling imported DLL functions from an injected DLL?

Reverse Engineering Asked by Nikita Buyevich on December 26, 2020

If I have injected my own DLL into an executable (a game specifically) which imports a DLL to draw its graphics, camera, etc. How can I go about calling the DLLs functions?

I’m able to find the executables functions and hook them/call them at will, but I’m having trouble wrapping my head around how to do the same thing for the DLL which has the real goodies I want to call/manipulate.

I’m using IDA Pro to decompile the executable to get a good sense of what’s happening. I’m still a beginner at this stuff but I think the dword_xxxx references is when the executable is calling DLL functions? Things like this for example:

enter image description here

One Answer

I guess you need the base address of the loaded DLL to install your hooks. You can simply call GetModuleHandleA/W if the DLL is already loaded or LoadLibraryA/W if the DLL is loaded later. Once you get the base address, you have to add the RVA to this value, and you'll have the virtual address. Or you can use GetProcAddress to retrieve the virtual address of the exported functions.

Regarding your screenshot, I didn't get it sorry. But I can't see any call instruction. I guess this is a pointer store in a global value. Probably not related to a DLL.

Answered by wisk on December 26, 2020

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP