blabberer
December 14th, 2004, 06:49
well olly when loading a dll will stop at Module Entry point which is used for initialization of dll this does not mean that the olly has loaded the dll completely
for example when you load any exe it will stop at entry point and will not run the exe automatically it is same logic that is used in dlls too
you have to either single step or run the exe (f7,f8,f9,run to selection etc etc etc) like wise you have to run the dll first to let it complete its initialization process (the Module Entry point can be used to perform n number of actions search for a post by me in this forum i think the topic is error 11 there is an mskb link to the details about Module Entry point or better use google for updated info)
if you happen try the view debug dll export before the dll has initialized it wont be available
you should let olly complete the initialization of dll and say running in status bar instead of paused before you try to use the view debug dllexport menu
only then it wil pop up the dialog
after this you can look for its exported function ,view in dissembler,set bp
call function etc etc
now this can also be achieved if you have the exe that uses this dll
options --> debugging options--->events --->break on dll load
when a dll is loaded olly will stop and notify you of the event
then you can right click follow the ep and search for names on the specific
then do a find referance by right clicking on names window and set bp on
calls in the dll
or rather load the exe use find names in current module ,then find referances to it and set bp directly
there are lot of ways
some more hacks would be to hexedit the ep of dll to infinte jump
eb fe and make it loop for ever and then use f12 to pause
and some more hacks would be to change the dlls charecteristics to
that of exe and load it directly as exe instead of it being dll
or if you know that dll imports some standard functions and you are using
OS >= w2k then you can set bp on that fuction and when it breaks
look into call stack to see the call or its return and follow from there
i can go on and on and on

so let me stop here
the only way you are going to understand every bit of my ramblings
would be to experiment and read the help file and especially GOOGLE
for info nothing will be available on a platter at one place but everything is available in bits and pieces some where on this whole wide world
well i dont think you are going to read till here
goodluck to you if you finished reading and find out what to do
