Learning Malware Analysis

3.7 Debugging a Malicious DLL Using IDA

In Chapter 3, Dynamic Analysis, you learned the techniques to execute a DLL to perform dynamic analysis. In this section, you will use some of the concepts that you learned in Chapter 3, Dynamic Analysis, to debug a DLL using IDA. If you not familiar with dynamic analysis of a DLL, it is highly recommended to read Section 6, Dynamic-Link Library (DLL) Analysis, from Chapter 3, Dynamic Analysis, before proceeding further. 

To debug a DLL using the IDA debugger, you first need to designate the executable (such as rundll32.exe) that will be used to load the DLL. To debug a DLL, first, load the DLL into IDA, which will likely display the disassembly of the DLLMain function. Set a breakpoint (F2) at the ...