How can I find the parameters of an undocumented Dll function?
I have searched all over the internet and ended up finding one way: it involves decorated functions. However, I cannot find a way to get those.
Any help would be appreciated.
Share
Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
How can I find the parameters of an undocumented Dll function?
I have searched all over the internet and ended up finding one way: it involves decorated functions. However, I cannot find a way to get those.
Any help would be appreciated.
You need to disassemble the application using, as Paul noted, something like IDA Pro (or the free version of the same).
A good introductory resource is the Wikibook, x86 Disassembly. Specifically, take a look at the section on functions and stack frames. Deducing function parameters can be straightforward for simple functions taking a few parameters of standard type.
Probably the best way to get started with this sort of thing is to create a small test DLL, create a few functions with known parameters, and then disassemble your DLL to see the patterns. Learn disassembly from your own functions (for which you have the source code and know the full signature) rather than plunging into disassembling third-party stuff.