Thursday, July 16, 2020

IDA Pro Debug Load DLL export function, getting Error WerMgr fault

If you are trying to debug a DLL and getting a wermgr fault using IDA it may be because you are using the WRONG version of rundll32.exe

there are 2 versions on a 64 bit windows 7/10 machine

c:\windows\system32\rundll32.exe    <-- this is the 64 bit and should be used with 64 bit dlls
c:\windows\syswow64\rundll32.exe  <-- this is the 32 bit and should be used with 32 bit dlls

so if i am analyzing a DLL with an export function such as "update.dll" with function "StartW"

if i open in PEstudio and see that it's a 32 bit DLL then my IDA Debugger -> process options would be

Application: c:\windows\syswow64\rundll32.exe
Input file: [my dll path]
Directory: [my dll folder]
Parameters: [my dll path], [my export function]

I noticed that initially i was trying
Application: c:\windows\system32\rundll32.exe

but rundll32 would just crash and IDA would never hit my breakpoint
but if i changed it to
Application: c:\windows\syswow64\rundll32.exe

then it would hit my breakpoint in IDA

nice!

1 comment:

  1. I want to thank Dr Emu a very powerful spell caster who help me to bring my husband back to me, few month ago i have a serious problem with my husband, to the extend that he left the house, and he started dating another woman and he stayed with the woman, i tried all i can to bring him back, but all my effort was useless until the day my friend came to my house and i told her every thing that had happened between me and my husband, then she told me of a powerful spell caster who help her when she was in the same problem I then contact Dr Emu and told him every thing and he told me not to worry my self again that my husband will come back to me after he has cast a spell on him, i thought it was a joke, after he had finish casting the spell, he told me that he had just finish casting the spell, to my greatest surprise within 48 hours, my husband really came back begging me to forgive him, if you need his help you can contact him with via email: Emutemple@gmail.com or add him up on his whatsapp +2347012841542 is willing to help any body that need his help.

    ReplyDelete