0

I've been looking into the PE format using a random DLL as a test case. When I look manually at the entry point specified in the optional header (and add the image base, because RVA) it doesn't match the entry point address IDA gives in the exports list.

I know reading the entry point from the DLL isn't the problem, since if I calculate:

(AddressOfEntryPoint - [.text section virtual]) + [.text section offset]

(which should give the file offset to the entry point) you can find at the offset the same bytes that IDA says should be in the entry function.

Also I know that IDA must be calculating the entry point from this field since DLLEntryPoint isn't in the exports list.

Am I missing something? If I do the same analysis on a normal executable everything works.

  • "it doesn't match the entry point IDA gives" -- Are you referring to the entry point IDA shows you when you're statically disassembling the DLL, or the entry point you see at runtime when debugging the DLL with IDA? – Jason Geffner May 23 '15 at 15:45
  • @JasonGeffner the static DLL entry point, which should, AFAIK, be the same at runtime if it wasn't relocated. – crazyhatfish May 23 '15 at 15:56
  • What is the Image Base according to the PE headers? And when you scroll up to the very top of IDA's disassembly, what does IDA report as the "Imagebase"? (should be right after the line "Format : Portable executable for 80386 (PE)") – Jason Geffner May 24 '15 at 17:28
  • @JasonGeffner The image base is the same in the headers as in IDA, 0x10000000, which is a bit off from the default 0x400000 but I guess that's to save relocating. – crazyhatfish May 24 '15 at 21:40
  • Please post screenshots of the mismatch and/or share a link to the binary. – Jason Geffner May 25 '15 at 16:32
2

When you open a DLL file with IDA, if IDA is able to find the DllMain() function then it will automatically navigate to that function when you first disassemble the DLL. Note that the DLL's entry point (which IDA names "DllEntryPoint") does not always (and in fact often does not) point to the DllMain() function.

You can see in the image below (full-size at http://i.imgur.com/fuaKqdk.png) that the DLL's entry point is 10807A1C. I've pointed from the entry point's artificial entry in the Exports table (since IDA gets the address from the PE's Entry Point field, not the actual PE Export Table) to the disassembly for the entry point code via arrow #1.

The code at the entry point (named DllEntryPoint() by IDA) calls ___DllMainCRTStartup() via arrow #2. Then __DllMainCRTStartup() calls DllMain() via arrow #3.

The two function executed before DllMain() are from VC++ 6's runtime library.

IDA

  • Thanks for all your help man, I appreciate it. I've just realized the mismatch was down to the IDA db being out of sync, as always just a very stupid mistake. Nothing wrong with your answer though. – crazyhatfish May 28 '15 at 11:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.