How to run and reconstruct a packed DLL in IDA Pro?

Question

I have a packed DLL. It has an entry point. If I call LoadLibrary it gets unpacked with the entry point code. Then I can attach a debugger to the .exe that called LoadLibrary and see the unpacked dll dissasembly in my debugger.

I know IDA has a "universal unpacker" plugin, as well as a "reconstruct" option. But I have the .dll open in IDA. A .dll can't be executed, so I can't seemingly use these tools.

I have a memdump of the unpacked .dll, but I had trouble importing it manually in IDA. That doesn't seem like a promising route.

Maybe I can create a custom console application that will load the .dll using LoadLibrary and then somehow call IDA PRO on that running instance?

The .dll is so packed there are no exports table at all. I presume there are memory addresses that are given to the .dll user - and that's how the calling works. I've working on figuring out those addresses.

Any help appreciated!

Answer 1

I have a memdump of the unpacked .dll, but I had trouble importing it manually in IDA. That doesn't seem like a promising route.

This is exactly the way to go. Given the right offset, this should work like charm. If you have any problems here, consider asking another question about it.

Maybe I can create a custom console application that will load the .dll using LoadLibrary and then somehow call IDA PRO on that running instance?

Yes. You should be able to use a program which only consists of a LoadLibrary call. LoadLibrary should map the library to your process space and execute its WinMain Function (which I presume is in charge of unpacking). If the unpacking functionality is not included in the .dll itself, you should really reconsider using a memory dump.