Log in

View Full Version : How to reverse a DLL without .exe (Matlab)


Zero
February 19th, 2003, 03:24
A nice problem I am working on:

You can compile with matlab from c++ sources directly DLL´s.
So what you get is only a DLL which you can use within your projects.

for the c++ file you just have to define:

#include "mex.h"

and something like (The name of the file is: myDLL.c):

Code:

void calcDetection(double x[],double y[], double z[])
{
if (y[0] == 1){
z[0] = DoDet(x[0],1);
} else {
z[0] = DoDet(x[0],y[0]);
}
}

void mexFunction( int nlhs, mxArray *plhs[],
int nrhs, const mxArray *prhs[] )
{
double *x,*y,*z,*myType;
float myFloatType;

if(nrhs!=2) {
//mexErrMsgTxt("Two inputs required.";
} else if(nlhs>1) {
//mexErrMsgTxt("Too many output arguments";
}
plhs[0] = mxCreateDoubleMatrix(1,1, mxREAL);


x = mxGetPr(prhs[0]); // get first parameter in x
y = mxGetPr(prhs[1]); // get second parameter in y
myType = mxGetPr(prhs[2]); // get second parameter in y
z = mxGetPr(plhs[0]); // z contains our return value

myFloatType = *myType;
if (myFloatType == 1.00){
// do detection
calcDetection(x,y,z);
}
}


after compiling with MEX you get a DLL named myDLL.dll
You just have to throw this .dll into the directory where the main file is running

within a Matlab file you just call the function of the DLL like:

myDLL(0,1,1);

Very simple.

Now we get to the problem:

For calling the function MyCoolFunction you just have to add this in your code (assuming it exists in the .dll):

Code:

...
MyCoolFunction(param1,param2);
...


This accesses directly any (!) .dll within your path and searches the function MyCoolFunction(...).

BUT:

The function seems to be defined like this:
Code:

MyCoolFunction(param1,param2){
...
checkLicense();
...
normalCode
}


The cool thing is:
you can not see the MyCoolFunction with an app like FileInspector because there are NO exports defined !

So there are ONLY 2 ways to reverse this:

1. Reversing the Matlab Environment and hoping that you will somewhere land within the checlLicense routine. After years you know every line within Matlab but maybe not one line of the DLL
2. Reversing the DLL directly

So I want to reverse the DLL directly....

But HOW ?

btw:
if you search for strings within the DLL you find a text-resource like this: "License Invalid"

Zero
February 19th, 2003, 03:57
Actually cracking this scheme was quite easy:

1. use PE-Explorer to disassemble the DLL
2. search for the string reference
3. find the location where this string ref is called
4. patch it or whatever (I used HIEW)

5. please move this topic to the newbie forum

Sorry for posting such a lame appraoch to the advanced forum...

CADZzz
February 27th, 2003, 06:03
Try to use the Ollydbg debugger, its excellent for adjusting dll's

1. First load the prog into Ollydbg
2. View-executable modules
3. double click the dll
4. now you r in the dll and do whatever u want...save it etc...

regards,
CADZzz

Zero
February 27th, 2003, 07:20
sure you are right with using Olly, BUT:

please read what I have written above !

There is NO .exe file existing !
The DLL is called by Matlab with a different way, so I had to reverse the DLL directly (describe above too)