Cheat Engine

NoMercy

Hello,

I'm trying to read all API calls a .dll makes, seems like I've to make a dump of the file. Downloaded dark olly, tried one of the add ons, did not work out very well.

If someone could help me here?

Thanks.

AhMunRa · Posted: Thu Jan 27, 2011 1:23 pm Post subject:

Have you tried Import Reconstructor?

You may have to search a bit to find it.

NoMercy · Posted: Thu Jan 27, 2011 3:23 pm Post subject:

Thanks,

but that's if the process is running, This process is hided so...

Anyone has other ideas?

AhMunRa · Posted: Thu Jan 27, 2011 4:52 pm Post subject:

Are you trying to reverse engineer a virus?

atom0s · Posted: Fri Jan 28, 2011 1:25 am Post subject:

Just dump the IAT from the file itself. (Binary not while loaded.)

If the file is packed either unpack it, or hook GetProcAddress and print out all the functions it looks up pointers for.

NoMercy · Posted: Sat Jan 29, 2011 4:08 am Post subject:

I do not know how to unpack etc.

If I do hook GetProcAddress, do I see all API imports? So a program uses it always to determine what to call?

atom0s · Posted: Sat Jan 29, 2011 6:12 am Post subject:

sloppy · Posted: Sat Jan 29, 2011 12:45 pm Post subject:

Play around with WinAPIOverride or the traceapi sample from Microsoft Detours to get a quick look at the windows api calls.