是否有代理不需要 IDA Pro 的 dll 的工具?

逆向工程 艾达 视窗 工具 dll
2021-07-09 04:24:51

我发现了一个在第一次尝试时就编译干净的 github 项目(对我来说可能是第一个,是的!)。没有说明,所以我偶然发现了一个糟糕的 Youtube 视频……一切都很顺利,直到我达到了两分钟的标记,然后它有一个标题为“在 IDA Pro 64 中打开”的部分。

我查看了他们的网站... 589 美元以上。考虑到这个个人项目的性质,这有点超出预算。

是否有一个 dll 代理工具/系统可以将调用/参数写出到日志文件或类似的东西?

2个回答

Looks like you're looking for an API monitoring tool. There are plenty of those, including my personal favorite being Rohitab's API Monitor.

An API monitoring tool will record all API calls performed by a process, thier parameters and return values. Features depend on the specific tool but Rohitab's is really complete (and free). Googling for API monitoring tools will provide other good results.

Additionally, IDA has both a limited demo version and an old freeware version. One of those is ought to be enough for what you seem to be looking for.

This project here generates Visual Studio code for building plain proxy dlls:

https://github.com/mavenlin/Dll_Wrapper_Gen

It's based off an older project called "wrapit", which also generates VS code, but takes a little more work:

http://www.codeproject.com/Articles/16541/Create-your-Proxy-DLLs-automatically

I've had some luck with both, they generate valid code that I can build DLLs with. As these are native, functioning DLLs, they should avoid any trouble with anti-debugger code that detects a debugging process hooking in (though, there are conceivably counter-measures that could defeat this attempt too).