I'm new to malware analysis. I was following through this lab :https://jmprsp.wordpress.com/2016/03/06/practical-malware-analysis-ollydbg-lab-9-03/

I observed that the DLL loaded before and after run time are different. May I know how is it possible to load a DLL only during run-time?


"DLL" means "Dynamic-Link Library".

Its whole purpose is to be loaded at runtime, to provide the symbols (essentially: function names) that an application uses from the library.

So, you simply supply the run-time linker with your DLL, and supply the linker at compile-time (link-time, to be exact) another one. The only thing they have to agree on is to contain the same symbols.

  • thanks marcus. how do i find the run-time linker in a disassembled code? – misctp asdas Dec 1 '16 at 10:26
  • you're a bit clueless. Read an article on the binary format you're looking at (probably PE32 if you're on windows, ELF if you're on Linux), and what the runtime linker of your platform (windows runtime linking or libc/Linux Kernel on Linux) does. – Marcus Müller Dec 1 '16 at 10:28
  • You don't have to "hack" anything to make the runtime linker load a different library – just offer it to him. It's perfectly normal behavior! In other words, why are you disassembling this? It's nothing you'd need to disassemble. – Marcus Müller Dec 1 '16 at 10:28
  • @misctpasdas The standard way is just calling existing Windows API functions like LoadLibrary to load the dll, but if the software want to be sneaky it can just allocate executable memory with VirtualAlloc and write code into it (or with a bit more work, even a full DLL). – CodesInChaos Dec 1 '16 at 11:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.