I want to use the IDA Freeware Version 7.7 for finding the DllMain of a DLL file. The file is from the book Practical Malware Analysis. It is for Lab 05. Name of file is "Lab05-01.dll" and you can download that from here (use VM).
So as Practical Malware Analysis mentioned, when I load the DLL at IDA Freeware, then, the first line of instruction at the graph view should be the start of DllMain.
But when I load the DLL file at the IDA Freeware, the first line of graph view is NOT the
DllMain. Because I checked from the solutions and my answer and book's answer were not the same.
Ways that I've Tested
- Looking at the first line of instruction at the graph view which the book described. (Explained above that didn't worked)
- So I searched and found THIS ARTICLE.
One of the ways that was mentioned there was to go and find
DllMainat the function windows. There was no function named
DllMain(As you see in the picture) The
DllMaindoes NOT exist because if it did exist, then it would be above
DllEntryPoint. (Note that I have sorted by name)
- So next thing I did was to look at the answer and see what is the name of the function which starts at the exact same address which the book says DllMain starts.
The book says the answer is 1000D02E. I look at the function which had started from this location and that function had this name : sub_1000D02E , not
DllMain. The function highlighted is the DllMain (I know this because I have looked at the solutions and as you see the function's name is not
DllMainand I was unable to find that by myself)
What should I do to find the DllMain?
Thank you in advance.