Get external dll file commands

Question

I have a DLL file that is used by the application for the video player, this video player uses this DLL file to export video in AVI format, what is the way to find out how this application uses the DLL file so that I can execute it from the outside?

I have a copy of the file here Dropbox .

Answer 1

As Raymond said, there is no formal way to test interfaces supported by DLLs.

At best, you have the following options:

• Type dumpbin /exports lkExport.dll to find out which features are exported. You will not see function signatures or return types, but you may recognize them as a well-known plugin interface standard for your specific application. Perhaps the media player application itself has a plug-in SDK where these functions are documented. In your case, I see what looks like Java bindings, which are also exported by this DLL ... this may be a prospect for study.

• Try to see if there is a DLL for COM and it is exporting a type library. I have not seen any of the usual COM functions exported, but you can load the DLL in Visual Studio using the resource editor and look for it.

• The resource editor did not detect a type library, so this probably excludes COM. But it does show an art resource showing tooltips showing the name of the product or company that created the DLL. I see both "Linktivity" and "Inter-Tel (Delaware), Inc." in the list. A quick web search reveals that they may not be in business, but you are probably a smart and resourceful person ...

• It remains only to try to connect a debugger (for example, windbg) to the application that loads the DLL and sets breakpoints on the exported functions and parses the stack and tries to deduce the types of function parameters, return values ​​and the value of each of them. I suspect that it will be very difficult to do if you do not have a PDB character file that corresponds to the assembly of this DLL. (Maybe you can send bp to the exported funtion DLL without characters? I never tried ...) There are people who can do such things ...

Some tips:

 dumpbin /exports lkExport.dll C:\Users\jselbie\Downloads>dumpbin /exports lkExport.dll Microsoft (R) COFF/PE Dumper Version 14.11.25506.0 Copyright (C) Microsoft Corporation. All rights reserved. Dump of file lkExport.dll File Type: DLL Section contains the following exports for lkExport.dll 00000000 characteristics 47606859 time date stamp Wed Dec 12 15:01:45 2007 0.00 version 1 ordinal base 14 number of functions 14 number of names ordinal hint RVA name 1 0 00001A80 DispatchMsg 2 1 00001AD0 Init 10 2 00001D00 ReceiveMsg 11 3 00001D90 SendMsg 12 4 00001DB0 SendMsgProc 13 5 00001B70 Start 14 6 00001C40 Stop 3 7 00001A40 _Java_linktivity_nativecontrols_ExportAppletDll_DispatchMsg@20 4 8 000018B0 _Java_linktivity_nativecontrols_ExportAppletDll_Initialize@24 5 9 00001980 _Java_linktivity_nativecontrols_ExportAppletDll_ReceiveMsg@16 6 A 00001920 _Java_linktivity_nativecontrols_ExportAppletDll_ReceiveNodeMsg@2 0 7 B 000019C0 _Java_linktivity_nativecontrols_ExportAppletDll_SendMsgProc@16 8 C 00001900 _Java_linktivity_nativecontrols_ExportAppletDll_Start@8 9 D 00001910 _Java_linktivity_nativecontrols_Ex portAppletDll_Stop@8 

Answer 2

I think you will succeed with WinAPIOverride .

It allows you to check all calls in the DLL and see what happens and what goes beyond each call.

Answer 3

Well, when we talk about DLLs and how to implement it, you need to have documentation for this DLL and even more, if any, and a private library that is not an open source product that will be used.

In this case, with the library that you shared, you are talking about a standard library that can be analyzed using several tools, such as Dependency Walker and check which interfaces are available in the DLL, but you can get information on how to use it with parameters , and if the interfaces return some type. You can also see what other libraries this file needs, as you can see in the image below.

So, in your case, you should have documentation to see how to use and embed the library in your code.