Find DllMain using IDA Freeware

Question

I want to use the IDA Freeware Version 7.7 for finding the DllMain of a DLL file. The file is from the book Practical Malware Analysis. It is for Lab 05. Name of file is "Lab05-01.dll" and you can download that from here (use VM).

So as Practical Malware Analysis mentioned, when I load the DLL at IDA Freeware, then, the first line of instruction at the graph view should be the start of DllMain.

But when I load the DLL file at the IDA Freeware, the first line of graph view is NOT the DllMain. Because I checked from the solutions and my answer and book's answer were not the same.

Ways that I've Tested

1. Looking at the first line of instruction at the graph view which the book described. (Explained above that didn't worked)
2. So I searched and found THIS ARTICLE. One of the ways that was mentioned there was to go and find DllMain at the function windows. There was no function named DllMain (As you see in the picture) The DllMain does NOT exist because if it did exist, then it would be above EnumProcessModules and below DllEntryPoint. (Note that I have sorted by name)
3. So next thing I did was to look at the answer and see what is the name of the function which starts at the exact same address which the book says DllMain starts. The book says the answer is 1000D02E. I look at the function which had started from this location and that function had this name : sub_1000D02E , not DllMain. The function highlighted is the DllMain (I know this because I have looked at the solutions and as you see the function's name is not DllMain and I was unable to find that by myself)

---

What should I do to find the DllMain?

Thank you in advance.

Answer 1

Hmm, so here's the rub. I installed IDA Freeware 7.7 in my Linux VM and tried in parallel in my named license IDA Pro 7.7.

Turns out this seems to be a limitation of IDA Freeware, in all likelihood a conscious one. In particular I can see with the freeware version that DllEntryPoint was not deemed a library function (cyan color), but with the commercial license it was.

Freeware:

Commercial:

It appears that based on autoload.cfg my commercial IDA will load FLIRT signatures vc32rtf (Microsoft VisualC 2-14/net runtime), which the freeware version doesn't do on its own.

If you do that manually through File -> Load file -> FLIRT signature file your DllEntryPoint function should get collapsed and its color should indicate it's a library function (cyan). You can toggle collapsed/expanded mode with Ctrl+Num+ by default.

Now, if you expand the function you will notice it has been recognized as a library function, but so have some of the callees called from this library function. What's more, if you use View -> Open subviews -> Function calls you can see the overview of calls from DllEntryPoint.

As you can now see, there are only two called "entities" which aren't themselves library functions (call eax ; dword_10092E58 and call sub_1000D02E). And after a cursory look under which conditions the function pointer stored in dword_10092E58 gets called, we can surmise that sub_1000D02E must be our DllMain.

Knowing this, we can now jump to it and manually rename it to DllMain. Once done it should show up as:

.text:1000D02E ; BOOL __stdcall DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
.text:1000D02E DllMain         proc near               ; CODE XREF: DllEntryPoint+4B↓p
.text:1000D02E                                         ; DATA XREF: sub_100110FF+2D↓o

... in the "IDA View-A".