what routine in ntdll.dll is responsible of dispatching DllMain function of loaded dll?

Question

I'm trying to debug a dll file using Ida disassembler and Windbg. I'm debugging rundll32.exe and passing the target dll (debugee) as an argument. I'm able to have a breakpoint on each Dll load & unload, but I'm looking for a way to debug the target dll Main function. I want to put a breakpoint on the dispatcher of the dll main function in the loader (ntdll.dll) in order to do this. What is the routine responsible for dll main dispatching? My environment is windows 10 version 1809.

Answer 1

using windbg you can set an sxe ld:Modname event break

assuming you are running this which will pop up a help gui for printers

rundll32.exe printui.dll PrintUIEntry /?

if you want to Break on this printUI.dll's CrtMain or AddressOfEntryPoint you can do it like this

C:\WINDOWS\system32>cdb rundll32.exe printui.dll PrintUIEntry /?

Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
ntdll!LdrpDoDebuggerBreak+0x30:
00007ffc`b725121c cc              int     3

0:000> sxe ld:printui.dll    
0:000> .sxcmds
sxe ld:printui.dll ;

0:000> g
ModLoad: 00007ffc`a04e0000 00007ffc`a058d000   C:\WINDOWS\system32\printui.dll
ntdll!NtMapViewOfSection+0x14:
00007ffc`b721c5c4 c3              ret

0:000> .lastevent
Last event: 1d84.293c: Load module C:\WINDOWS\system32\printui.dll at 00007ffc`a04e0000
  debugger time: Mon May 25 23:55:59.235 2020 

0:000> .shell -ci "!dh 00007ffc`a04e0000" findstr /I Entry
    3CA0 address of entry point
.shell: Process exited

0:000> bp 00007ffc`a04e0000+3ca0
0:000> bl
 0 e 00007ffc`a04e3ca0     0001 (0001)  0:**** printui!DllMainCRTStartup
0:000> g
ModLoad: 00007ffc`b5950000 00007ffc`b59f3000   C:\WINDOWS\System32\ADVAPI32.dll
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Breakpoint 0 hit
printui!DllMainCRTStartup:
00007ffc`a04e3ca0 48895c2408 mov qwordptr[rsp+8],rbx ss:0000009a`5918edd0=0000000000000000

and you can see the call stack to find all the responsible calls that leads to this break

0:000> k
Child-SP          RetAddr           Call Site
0000009a`5918edc8 00007ffc`b71a50a1 printui!DllMainCRTStartup
0000009a`5918edd0 00007ffc`b71e9405 ntdll!LdrpCallInitRoutine+0x65
0000009a`5918ee40 00007ffc`b71e91f8 ntdll!LdrpInitializeNode+0x1b1
0000009a`5918ef80 00007ffc`b71aaa97 ntdll!LdrpInitializeGraphRecurse+0x80
0000009a`5918efc0 00007ffc`b71a2591 ntdll!LdrpPrepareModuleForExecution+0xbf
0000009a`5918f000 00007ffc`b71a22a8 ntdll!LdrpLoadDllInternal+0x199
0000009a`5918f080 00007ffc`b71a1764 ntdll!LdrpLoadDll+0xa8
0000009a`5918f230 00007ffc`b43e56f0 ntdll!LdrLoadDll+0xe4
0000009a`5918f320 00007ff7`ff62356e KERNELBASE!LoadLibraryExW+0x170
0000009a`5918f390 00007ff7`ff623aff rundll32!_InitCommandInfo+0x82
0000009a`5918f7e0 00007ff7`ff6262d9 rundll32!wWinMain+0x1ef
0000009a`5918fa50 00007ffc`b6287bd4 rundll32!__wmainCRTStartup+0x1c9
0000009a`5918fb10 00007ffc`b71eced1 KERNEL32!BaseThreadInitThunk+0x14
0000009a`5918fb40 00000000`00000000 ntdll!RtlUserThreadStart+0x21