DLL entry point in memory

Question

I've been looking into the PE format using a random DLL as a test case. When I look manually at the entry point specified in the optional header (and add the image base, because RVA) it doesn't match the entry point address IDA gives in the exports list.

I know reading the entry point from the DLL isn't the problem, since if I calculate:

(AddressOfEntryPoint - [.text section virtual]) + [.text section offset]

(which should give the file offset to the entry point) you can find at the offset the same bytes that IDA says should be in the entry function.

Also I know that IDA must be calculating the entry point from this field since DLLEntryPoint isn't in the exports list.

Am I missing something? If I do the same analysis on a normal executable everything works.

Answer 1

When you open a DLL file with IDA, if IDA is able to find the DllMain() function then it will automatically navigate to that function when you first disassemble the DLL. Note that the DLL's entry point (which IDA names "DllEntryPoint") does not always (and in fact often does not) point to the DllMain() function.

You can see in the image below (full-size at https://i.stack.imgur.com/CMUou.png) that the DLL's entry point is 10807A1C. I've pointed from the entry point's artificial entry in the Exports table (since IDA gets the address from the PE's Entry Point field, not the actual PE Export Table) to the disassembly for the entry point code via arrow #1.

The code at the entry point (named DllEntryPoint() by IDA) calls ___DllMainCRTStartup() via arrow #2. Then __DllMainCRTStartup() calls DllMain() via arrow #3.

The two function executed before DllMain() are from VC++ 6's runtime library.