Lab LoadingDLLs - The various ways of loading a LoadingDLLs
The binary for this lab is not malware (not even a toy malware). It is meant to illustrate how DLLs are loaded when a binary is executed.
The binary and some of the DLLs that it uses are in: http://ccom.uprrp.edu/~rarce/ccom4995/misc/loadingDLLs.zip
-
Use PEView to see the IMPORT Address Table of the
ada.exe
(under SECTION .rdata). What four DLLs are mentioned in this table? -
What is the name of the imported function from DLL1.dll?
-
What are the names of the imported functions from DLL2.dll?
-
Load the binary in OllyDbg and pause on the first instruction of the
main
function. You may use IDA to find out what instruction that is. Use the E button (theE
stands for Executable Modules ) in OllyDbg to see the memory map of the program. Notice that both DLL1.dll and DLL2.dll have been loaded and assigned addresses within the memory map.-
What is the base address for DLL1?
-
What is the base address for DLL2?
-
-
What does the
DLL1print
function do? -
Explain your answer to the previous question.
-
What function assigns a value to the variable that is printed by
DLL1print
? -
To what does that value printed by
DLL1Print
correspond? -
Explain your answer to the previous question.
-
The second subroutine that is called is DLL2Print. It prints "DLL 2 mystery data " followed by an integer which corresponds to what?
-
Explain your answer to the previous question.
-
What is the name of the file that is created during the DLLMain of DLL2.dll?
-
What is the name of the variable that IDA assigns to handle of the file?
-
What text is being written to the file when the function WriteFile is invoked?
-
Explain your answer to the previous question.
-
Run the program in OllyDbg until just after the call to LoadLibraryA. This is the function that loads the
DLL3.dll
. What base address is assigned to DLL3.dll. (Hint: see it in the Executable Modules window in OllyDbg) -
What are the two DLL3.dll functions invoked by the binary?
-
What function is used for finding the address of the functions in DLL3.dll?
-
The subroutine
DLL3Print
prints "DLL 3 mystery data " followed by the content of a global variable. Explain what this integer means, i.e. what function's result is used for changing the value of the global variable.