1

I'm new to malware analysis. I was following through this lab :https://jmprsp.wordpress.com/2016/03/06/practical-malware-analysis-ollydbg-lab-9-03/

I observed that the DLL loaded before and after run time are different. May I know how is it possible to load a DLL only during run-time?

Improve this question

1 Answer 1

Reset to default
3

"DLL" means "Dynamic-Link Library".

Its whole purpose is to be loaded at runtime, to provide the symbols (essentially: function names) that an application uses from the library.

So, you simply supply the run-time linker with your DLL, and supply the linker at compile-time (link-time, to be exact) another one. The only thing they have to agree on is to contain the same symbols.

Improve this answer
4
  • thanks marcus. how do i find the run-time linker in a disassembled code?
    – misctp asdas
    Dec 1, 2016 at 10:26
  • you're a bit clueless. Read an article on the binary format you're looking at (probably PE32 if you're on windows, ELF if you're on Linux), and what the runtime linker of your platform (windows runtime linking or libc/Linux Kernel on Linux) does.
    – Marcus Müller
    Dec 1, 2016 at 10:28
  • You don't have to "hack" anything to make the runtime linker load a different library – just offer it to him. It's perfectly normal behavior! In other words, why are you disassembling this? It's nothing you'd need to disassemble.
    – Marcus Müller
    Dec 1, 2016 at 10:28
  • @misctpasdas The standard way is just calling existing Windows API functions like LoadLibrary to load the dll, but if the software want to be sneaky it can just allocate executable memory with VirtualAlloc and write code into it (or with a bit more work, even a full DLL).
    – CodesInChaos
    Dec 1, 2016 at 11:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .