I am currently analyzing some malware which loads a DLL from an embedded resource and executes it. Normally I would dump the DLL and create a separate database for the DLL. However, I am running into an issue since the unpacker passes a structure to the DLL through DllMain (it still passes three arguments they just mean different things and the DLL accounts for this). The dll will not load properly if it is not loaded by the unpacker since it needs the information contained in this structure in order to run properly and will fail with an error code.
What I would like to do is define both the unpacker and the DLL in the same IDB since the DLL is always loaded at the same address I would like to be able to set a breakpoint on DLLMain and then run the unpacker. The unpacker would then decrypt and load the dll at that address and then I would be able to debug it from the DllMain I can do this fine just using the debugger, but I would like to have both the executable and the dll defined in my idb to make analysis easier and so that I can have my comments and other things saved in the IDB. Also the injected code is not analyzed by IDA which makes the disassembly hard to read.
My question then is how do I do this? I took a memory snapshot after the dll is loaded, but before it is run and then saved that in a loadable segment, but IDA is not recognizing the file as a DLL. What should I do to get it so IDA recognizes both the embedded DLL and the executable in the same file. The DLL is not identified by IDA as a module or anything since it is not loaded by loadlibrary. I have been searching for hours trying to figure this out without making any decent progress whatsoever.
