Viewing an exported DLL function in OllyDbg - garbage code

Question

Being rather new to the concept of RE, I wanted to try and take a look at the assembly code in one DLL that I know exports some functions.

First, I used this tool - http://www.nirsoft.net/utils/dll_export_viewer.html - to obtain a list of exports within said DLL. These are some of the functions:

GI_Call 0x100590a7  0x000590a7  2 (0x2) mydll.dll   I:\test\mydll.dll   Exported Function   
GI_CleanReturnStack 0x10058eae  0x00058eae  3 (0x3) mydll.dll  I:\test\mydll.dll    Exported Function   
GI_Cmd_Argc 0x10058bd4  0x00058bd4  4 (0x4) mydll.dll   I:\test\mydll.dll   Exported Function   
GI_Cmd_Argc_sv  0x10059593  0x00059593  5 (0x5) mydll.dll   I:\test\mydll.dll   Exported Function   

When I, however, load the DLL up in OllyDbg and browse to any of these addresses, I get instructions that don't really resemble a beginning of a function, for example GI_Call:

100590A7     10E9                ADC CL,CH
100590A9     CE                  INTO
100590AA     FC                  CLD
100590AB     FFFF                ???                                                        ; Unknown command
100590AD     FF75 10             PUSH DWORD PTR SS:[EBP+10]
100590B0     8D45 FC             LEA EAX,DWORD PTR SS:[EBP-4]
100590B3     50                  PUSH EAX
100590B4     57                  PUSH EDI

What's even more puzzling is that once I scroll up/down, the code actually changes - there's no

100590A7     10E9                ADC CL,CH

anymore, it changes to a completely different instruction, also that address is gone.

Am I doing something wrong? Or is the DLL possibly encrypted? Though if it is, how could DLL Export Viewer dump the exports so easily?

Answer 1

Your library might get loaded to a location that's completely different from the one it wants to be loaded at, i.e. the address in the header, due to ASLR.

Also, when loading a DLL, Ollydbg doesn't load the DLL directly; instead, it uses loaddll.exe. Which means, it starts the executable, but the breakpoint it sets is before loaddll has a chance to, well, load the DLL.

Try the following:

• Set a breakpoint on LoadLibraryA : right click in CPU Window - Go To - Expression - LoadLibraryA - Press F2;
• Repeat the same with LoadLibraryW (the A version should be sufficient, just to make sure);
• Run the program;
• Once your breakpoint is it, press CTRL-F9 (execute till return);
• If your DLL depends on others, you'll hit one of your breakpoints again; else you'll hit the breakpoint at the RET instruction. Don't worry, in either case, your DLL will be loaded;
• Use View->Memory or View->Executable Modules to learn where your DLL was actually loaded. This may be the same address that DLL Export Viewer shows you, but often, it will be different (address conflicts between two DLLs, in which case one has to be relocated, or ASLR, as above);
• Only if the addresses match: Right Click -> GoTo -> Expression -> 0x12345678 or whatever address you want to see;
• No matter if they match or not: Right Click -> GoTo -> Expression -> (Function name) will scroll to that function.

The reason for your 'disappearing' instruction is that it's the middle of another instruction. Consider this function start:

10001280 > 53               PUSH EBX
10001281   56               PUSH ESI
10001282   57               PUSH EDI
10001283   8B7C24 10        MOV EDI,DWORD PTR SS:[ESP+10]
10001287   8BF1             MOV ESI,ECX
10001289   3BF7             CMP ESI,EDI
1000128B   0F94C3           SETE BL
1000128E   84DB             TEST BL,BL
10001290   75 32            JNZ SHORT 100012C4

The byte at 10001284, 0x7c, is part of the instruction at 1001283. But if you disassemble from 10001284,

10001284   7C 24            JL SHORT 100012AA
10001286   108B F13BF70F    ADC BYTE PTR DS:[EBX+FF73BF1],CL
1000128C   94               XCHG EAX,ESP
1000128D   C3               RETN
1000128E   84DB             TEST BL,BL
10001290   75 32            JNZ SHORT 100012C4

The wrong bytes get interpreted as instructions. Once you scroll up a few rows, Ollydbg syncs correctly again - and shows the 'real' instructions.