0

I've been looking into the PE format using a random DLL as a test case. When I look manually at the entry point specified in the optional header (and add the image base, because RVA) it doesn't match the entry point address IDA gives in the exports list.

I know reading the entry point from the DLL isn't the problem, since if I calculate:

(AddressOfEntryPoint - [.text section virtual]) + [.text section offset]

(which should give the file offset to the entry point) you can find at the offset the same bytes that IDA says should be in the entry function.

Also I know that IDA must be calculating the entry point from this field since DLLEntryPoint isn't in the exports list.

Am I missing something? If I do the same analysis on a normal executable everything works.

Improve this question
10
  • "it doesn't match the entry point IDA gives" -- Are you referring to the entry point IDA shows you when you're statically disassembling the DLL, or the entry point you see at runtime when debugging the DLL with IDA?
    – Jason Geffner
    May 23, 2015 at 15:45
  • @JasonGeffner the static DLL entry point, which should, AFAIK, be the same at runtime if it wasn't relocated.
    – user12522
    May 23, 2015 at 15:56
  • What is the Image Base according to the PE headers? And when you scroll up to the very top of IDA's disassembly, what does IDA report as the "Imagebase"? (should be right after the line "Format : Portable executable for 80386 (PE)")
    – Jason Geffner
    May 24, 2015 at 17:28
  • @JasonGeffner The image base is the same in the headers as in IDA, 0x10000000, which is a bit off from the default 0x400000 but I guess that's to save relocating.
    – user12522
    May 24, 2015 at 21:40
  • Please post screenshots of the mismatch and/or share a link to the binary.
    – Jason Geffner
    May 25, 2015 at 16:32

1 Answer 1

Reset to default
2

When you open a DLL file with IDA, if IDA is able to find the DllMain() function then it will automatically navigate to that function when you first disassemble the DLL. Note that the DLL's entry point (which IDA names "DllEntryPoint") does not always (and in fact often does not) point to the DllMain() function.

You can see in the image below (full-size at http://i.imgur.com/fuaKqdk.png) that the DLL's entry point is 10807A1C. I've pointed from the entry point's artificial entry in the Exports table (since IDA gets the address from the PE's Entry Point field, not the actual PE Export Table) to the disassembly for the entry point code via arrow #1.

The code at the entry point (named DllEntryPoint() by IDA) calls ___DllMainCRTStartup() via arrow #2. Then __DllMainCRTStartup() calls DllMain() via arrow #3.

The two function executed before DllMain() are from VC++ 6's runtime library.

IDA

Improve this answer
1
  • Thanks for all your help man, I appreciate it. I've just realized the mismatch was down to the IDA db being out of sync, as always just a very stupid mistake. Nothing wrong with your answer though.
    – user12522
    May 28, 2015 at 11:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.