PDA

View Full Version : Guess parameteres of exported dll functions


rvjr
05-07-2005, 08:00 AM
Hi!

I'm currently trying to use the 'HTCcamera1.dll' on my PocketLoox to take photographs with the integrated camera, but it is quite hard to guess the parameters of all functions. The init and deinit functions seemed to work till now. I also tried to replace the dll by another one (written by myself) which exports the same functions and I recorded the calls with their parameters to the dll, but I still couldn't guess how long the parameters were.

Is it probably possible to get this information out of the disassembly of the dll? Has someone experiences with that?

regards,
Rainer jr.

PS: should I post the dll here?

AndreaGeddon
05-10-2005, 10:54 AM
if you use Ida, it will resolve parameters for you :)
you can see which parameters are passed simply by looking the code in the procedure.
That is, in the disassembly you see various references to [EBP + xx], these are accesses to function parameters. First param is in ebp+8, second in ebp+0xC and so on, ida will resolve them for you and will display it at the beginning of the function along with local variables (that are ebp - xx). This is the way usually functions are compiled, sometimes due to optimization or convention call you could find a different form.
Once you find the parameters then you must understand the type and meaning of the requested parameters, and this can be a bit difficult :)
Bye!
AndreaGeddon