Reversing DLLs

Joe Giron opens by explaining why DLLs matter before anyone reverses them. He traces the move from DOS-era programs that were statically compiled to dynamic linking, which let Windows split functionality into separate libraries. He then covers how DLLs load and run: the entry point and its attach and detach events, exports referenced by name or ordinal, the COM-related exports he finds messy, and the Windows search order that decides which file actually gets loaded.

The middle of the talk covers how these mechanisms get abused and manipulated. He discusses KnownDLLs, search order hijacking to sideload DLLs into trusted or elevated programs, manifest redirection, hooks, shared memory sections, AppInit_DLLs, and remote-thread injection. On the tooling side, he compares IDA and Ghidra for disassembly, uses x64dbg for debugging, and uses a small loader program to call exports without knowing their arguments.

For the case studies, he examines a CPU-Z DLL whose export fills a structure through GetNativeSystemInfo, a McAfee helper that defers file deletion with MoveFileEx, and an ASUS library whose download routine he traced back to InternetCrackUrl and InternetReadFile. By feeding it a URL and a destination, he got it to save a file. The takeaway is that when documentation is missing, tracing imports backward from known Windows APIs and probing inputs can reveal what a DLL does. The talk closes with a short Q&A.