Search code examples
windowsassemblydlldllexport

Adding an export to a DLL without recompiling it

I have a DLL that I want to use/debug. I don't have the source.

Looking at it with IDA, I found 3 things :

  1. DllMain does nothing
  2. The code I need is self contained in a function that only calls a few Windows API. It does not reference anything else in that DLL.
  3. That self contained function is not exported

I could extract the assembly code and link it to a C program, but I wonder:

Is it possible to (and how should I) add an entry to the export table of an existing DLL without recompiling it?

Solution

  • Yes, you can do that but most tools don't support this. For example using CFF Explorer, it's easier to convert an existing export to what you want it to be. Just edit the function RVA and exported name. Since you only need the one thing, it shouldn't be a problem that you're removing some other export.

    You could even do it with a hex editor since it doesn't involve moving anything rebuilding the header, it's just an in-place edit.