I have a packed DLL. It has an entry point. If I call LoadLibrary it gets unpacked with the entry point code. Then I can attach a debugger to the .exe that called LoadLibrary and see the unpacked dll dissasembly in my debugger.
I know IDA has a "universal unpacker" plugin, as well as a "reconstruct" option. But I have the .dll open in IDA. A .dll can't be executed, so I can't seemingly use these tools.
I have a memdump of the unpacked .dll, but I had trouble importing it manually in IDA. That doesn't seem like a promising route.
Maybe I can create a custom console application that will load the .dll using LoadLibrary and then somehow call IDA PRO on that running instance?
The .dll is so packed there are no exports table at all. I presume there are memory addresses that are given to the .dll user - and that's how the calling works. I've working on figuring out those addresses.
Any help appreciated!