Log in

View Full Version : Loading DLL-files???


Anonymous
February 25th, 2003, 09:55
Is it possible to load and adjust dll-files directly into Olly?

I ask it because i am working on a program that uses DLL-files to run outside the main program...but i am not able to adjust(patch) this dll...

Greetings...
CADZzz

helloword
February 25th, 2003, 10:05
It's very easy.
1.Load your main exe program.
2.View -->Executable Modules (Alt+E)
3.Right click on your dll in the list
4.view code in CPU (Enter)

For degugging issue, you can also add Break on new module (dll):
1. Options --> Degugging options
2. Events
3. Break on new module (dll) and even Break on module (DLL) unload
Then ollydbg will break in the right place and in the right moment

VOILA

Anonymous
February 26th, 2003, 02:32
Yep this is helping me!

thnx a lot

Greetz,

CADZzz

Anonymous
February 27th, 2003, 04:02
Problem 2:

Dll file:
Text strings referenced in wg_meng:.text, item 1489
Address=06F58385
Disassembly=PUSH wg_meng.06F88EF8
Text string=ASCII "Lock is not detected.
Please confirm if the Lock is properly connected to a Parallel Port."

The program pre-loads all the text strings in memory (cause its multilanguage i guess).
I found the dll with all the english text strings in it, but no calls were made to that dll at all (tested by setting bp's).

How can i find the place where the text is stored in memory and more important where its called from!

Regards,
CADZzz

Anonymous
February 27th, 2003, 14:02
1) search all the memory for text strings

2) place memory access breakpoint at the start of the string you are interested in.

3) run program and it'll breakpoint when it accesses that string.

Anonymous
February 28th, 2003, 03:27
K...thanks a LOT...got the message...
I managed to find a dll file which handles the strings.

I can now place bp's in the DLL...but every time i rerun the prog, i HAVE to set a LOT bp's all over again...

This is really annoying!
Does anybody know a good way to keep the bp's on the dll without the need to replace them again and again????

Regards,
CADZzz

(btw this is getting a complete tutorial this way

Anonymous
February 28th, 2003, 03:56
yes
When you are in the dll
Cltr+A to analyse the dll
After that the system will save your breackpoint

CADZzz
March 1st, 2003, 02:01
It works great...all i needed to know...

Thanks To Olly and all u helpfull forumreaders!

naceur
March 9th, 2003, 02:19
other problem:
is there a way to breack in a specific dll (in momery) and load it to analyse it. (so i load all the dlls in pop menu i don t found to load a specific dll).

Anonymous
March 9th, 2003, 10:35
yup, just setup options in ollydbg to "break on dll load".