views:

150

answers:

4

I have disassembled a VB6 application that calls a function in a DLL library, but I can't find any reference to the DLL in the disassembly. How can the calling code load this DLL? It is dynamically linked, as I can observe the effects of removing and replacing the DLL.

I'm using IDA Pro Free, the calling application is a VB6 app, and the DLL is a plain Win32 DLL that I suspect was created using C or C++.

+1  A: 

What do you mean by "can't find any reference"? you don't see the string of the dll name? you don't see the code who calls the dll?
You can put a break point in the dll and see the callstack that leads to the VB6 app.

Shay Erlichmen
Yes, I mean I can't find any code that refers to the dll, i.e. I don't see the string of the dll name, or the code that calls the dll.
ProfK
how does the stacktrace looks (when the dll is in a breakpoint)?
Shay Erlichmen
I'm still getting there, I haven't got a proper debugging setup yet.
ProfK
A: 

Open your application in PE Explorer, it will show you all the DLLs linked.

Wylder
+1  A: 

If it's a COM DLL, it may well be looking it up via GUID instead of name.

Promit
A: 

Have you searched for the Unicode version of the DLL name too? The application that loads the DLL might be built using wide characters.

Don Neufeld