1

Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason.

Most of the time I use rundll32.exe to load and debug any DLL and I just get this behavior with a few binaries.

The current lib I am debugging is quite simple, most of the logic of the program is executed by a thread created at the DLL's entry point. Then, its single export(DllRegisterServer) has a loop which checks if a flag has been set to finally call ExitProcess.

When I enter the main's logic thread I suspend any other thread and single step through it as always. As I go, randomly the DLL is unloaded, reloaded, and the dbg sets me again at DllEntryPoint, which makes the RE job quite annoying.

What could be the reason for that behavior?

Edit: Within x64dbg this does not happen. Same file, same command line.

Improve this question
5
  • Hi and welcome to RE.SE. Does the DLL have TLS callbacks? Any example that we could reproduce for ourselves?
    – 0xC0000022L ♦
    Apr 26, 2021 at 16:04
  • 1
    Hi there, the sample has no TLS callbacks and it is a sample of IcedID's(malware) new loader. If willing to play with a real file, samples can be found at MalwareBazaar under the IcedID tag and are easily unpacked by following a few VirtualAlloc calls.(Regarding the packing thing, the file I am working with is an unpacked standalone version.)
    – hariseldon
    Apr 26, 2021 at 16:45
  • Oh I forgot to mention that this behavior does not happen when I debug the same DLL, launched with the same command line with x64dbg. Although I am still curious about what could be causing this.
    – hariseldon
    Apr 26, 2021 at 16:47
  • Are you sure the DLL is actually reloaded, i.e. the module base differs? A DLL's entry point is called for 4 reasons, DLL_PROCESS_ATTACH, DLL_PROCESS_DETACH, DLL_THREAD_ATTACH or DLL_THREAD_DETACH, so maybe you're just getting thread notifications.
    – Johann Aydinbas
    Apr 28, 2021 at 2:07
  • @JohannAydinbas thanks a lot, I didn't know that DLLs are executed every time a thread is created or terminated. In my case, the main thread calls some Windows networking functions that create threads, resulting on the program performing several calls to DllMain with the DLL_THREAD_ATTACH fdwReason.
    – hariseldon
    Apr 29, 2021 at 15:01

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.