Determining Exported Function Properties from a Third-Party DLL

[darkcypher]

How would you determine the arguments and the function type of an exported function from a third-party DLL (with no API documentation available to you), and what tools would you have to use? Can this only be achieved with the assistance of a disassembler? If so, does anyone know any good resources for learning how to pick apart the assembly code generated by a disassembler and extrapolating such information?

Thanks in advance.

[Siddhartha]

How would you determine the arguments and the function type of an exported function from a third-party DLL (with no API documentation available to you), and what tools would you have to use? Can this only be achieved with the assistance of a disassembler? If so, does anyone know any good resources for learning how to pick apart the assembly code generated by a disassembler and extrapolating such information?

Thanks in advance.

Use Dependancy Walker (depends.exe) in the tools folder of your MSVC installation.

[darkcypher]

Thank you very much.

[Siddhartha]

Thank you very much.

You are welcome.

[Paul McKenzie]

How would you determine the arguments and the function type of an exported function from a third-party DLL (with no API documentation available to you), and what tools would you have to use?

The best tool is the internet, e-mail, or telephone -- contact the company that created the DLL and ask for the documentation. Even if you did know what type the arguments are (which you really can't do -- all you can determine is the size of each argument), what good is it? You don't know how to *use* the functions, what the parameters really mean, etc.

Sorry, but I have to ask this question -- why do you need to do this? Why don't you have the API documentation available?

The reason why I'm asking is because I'm suspicious anytime someone claims they don't have the documentation for a DLL, when almost every DLL that I know of that is meant for public consumption has documentation *somewhere*. Since my company sells libraries in the form of DLL's, we are *always* suspicious of anyone trying this.

Hopefully you are not trying to hack into a DLL that you are not supposed to.

Regards,

Paul McKenzie