#Dll reverse engineering Patch

This provides you a data source that can assist in rapidly reverse engineering the target.ĭLL injection is not limited to logging, though. For example, you can hook the IAT entry for a given imported operating system library function, and then log the function arguments onto disk. It's very commonly used for logging information while reverse engineering. My DLL does its business within the individual hooks, and then is programmed to redirect control back to the original process.ĭLL injection provides a platform for manipulating the execution of a running process. I can even do very surgical and targeted hooks at arbitrary locations, akin to old-school byte patching.

#Dll reverse engineering Patch

If I want to do the same with respect to some function that exists within the binary, I will make some sort of detours-style patch at the beginning of the function. If I am interested in modifying or observing the process' interaction with some imported function, then I will overwrite the IAT (Import Address Table) entry for that function and replace it with a pointer to something that I control. In the entrypoint, I will then invoke a routine that performs in-memory patching of all of the locations within the original binary that interest me, and redirects their execution into my DLL via a variety of modifications. From there, the entrypoint of the DLL will be executed by the operating system once it is loaded. To expand somewhat, I most often use DLL injection in the context of forcing an existing process to load a DLL through CreateRemoteThread.