Learning about DLL's

Index > Windows > Learning about DLL's

Author

Thread

fantasia

Joined: 02 Jul 2012
Posts: 10

fantasia

After studying, compiling and running ERRORMSG.asm in the FASM EXAMPLES directory, I thought I understood how to write a bare-bones DLL with FASM.

I clearly do not have a clue, though. The source code for my DLL compiles, as does the source for the program I am using to test it. However, when I run the test program, I get a message box containing the error:

---------------------------
Test.exe - Bad Image
---------------------------
myDLL.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support.
---------------------------
OK
---------------------------

Here is the source for myDLL.asm:

Code:

; myDLL.asm

format PE GUI 4.0 DLL
entry DllEntryPoint

include 'win32a.inc'

section '.text' code readable executable

proc DllEntryPoint hinstDLL,fdwReason,lpvReserved
     mov    eax,TRUE
     ret
endp

proc test_function
    mov    eax,TRUE
    ret
endp

section '.edata' export data readable
    export 'myDLL.dll',test_function,'test_function'

section '.reloc' fixups data readable discardable

And for Test.asm:

Code:

; Test.asm

format PE console 4.0
entry _main

include 'win32a.inc'

section '.text' code readable executable

  proc _main
        call    [test_function]
        ret
  endp

section '.idata' import data readable writeable
  library myDLL,'myDLL.dll'
  import  myDLL,test_function,'test_function'

section '.reloc' fixups data readable discardable

Please don't hold back if I have done anything stupid!

Thanks

03 Jul 2012, 09:12

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 17276
Location: In your JS exploiting you and your system

revolution

This depends upon your version of Windows. Some version of Windows allow you to load a program without linking to any APIs and some don't.

It would probably be best to at least link with kernel32.dll and import ExitProcess to give the Windows loader the information to load the standard APIs into the address space.

03 Jul 2012, 09:24

fantasia

Joined: 02 Jul 2012
Posts: 10

fantasia

I see, so the DLL is too minimal, then?

I tried to follow your advice but I think I probably made a mistake as I am getting the same error despite importing & calling ExitProcess in my Test program, as well as importing it into my DLL (I didn't call ExitProcess from in the DLL, though).

My amended source follows:

myDLL.dll:

Code:

; myDLL.asm

format PE GUI 4.0 DLL
entry DllEntryPoint

include 'win32a.inc'

section '.text' code readable executable

proc DllEntryPoint hinstDLL,fdwReason,lpvReserved
     mov    eax,TRUE
     ret
endp

proc test_function
    mov    eax,TRUE
    ret
endp

section '.idata' import data readable writeable
    library kernel32,'kernel32.dll'
    import  kernel32,\
            ExitProcess,'ExitProcess'


section '.edata' export data readable
    export 'myDLL.dll',test_function,'test_function'

section '.reloc' fixups data readable discardable

and for the test program:

Code:

; Test.asm

format PE console 4.0
entry _main

include 'win32a.inc'

section '.text' code readable executable

  proc _main
        call    [test_function]
        call    [ExitProcess]
  endp

section '.idata' import data readable writeable
  library kernel32,'kernel32.dll',\
          myDLL,'myDLL.dll'
  import  kernel32,\
          ExitProcess,'ExitProcess'
  import  myDLL,\
          test_function,'test_function'

section '.reloc' fixups data readable discardable

03 Jul 2012, 09:54

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 17276
Location: In your JS exploiting you and your system

revolution

You still have an empty import section if you don't reference any of the APIs. Use something like this:

Code:

proc DllEntryPoint hinstDLL,fdwReason,lpvReserved
     mov    eax,TRUE
     ret
     call [ExitProcess] ;dummy to force the macro to import the API
endp

Or populate the relocs section if you don't want to import any APIs.

Last edited by revolution on 03 Jul 2012, 10:18; edited 1 time in total

03 Jul 2012, 10:14

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 17276
Location: In your JS exploiting you and your system

revolution

BTW: Your relocs section in the DLL will also be empty when you don't import any of the system APIs in the DLL. A DLL does not need to import any APIs but it must have a non-empty relocs section.

03 Jul 2012, 10:17

AsmGuru62

Joined: 28 Jan 2004
Posts: 1409
Location: Toronto, Canada

AsmGuru62

@fantasia:
I think, recently there was a long thread on why some DLLs (built by FASM) fail on a newer Windows versions -- search the forum.

03 Jul 2012, 13:51

fantasia

Joined: 02 Jul 2012
Posts: 10

fantasia

@AsmGuru62

Thanks for the suggestion, but I was ineffective at searching because I didn't really understand what I was doing and hence what might have even gone wrong.

Since Revolution's remarks about initialization routines, I have been reading about the Ldr functions in ntdll.dll.

By the way, you don't know how to catch ntdll.dll in a debugger do you? Wink

03 Jul 2012, 15:00

AsmGuru62

Joined: 28 Jan 2004
Posts: 1409
Location: Toronto, Canada

AsmGuru62

You mean to set a breakpoint at WinMain of NTDLL.DLL?
I do not know how to do it.

Some DLLs are loaded by the OS before loading any other EXEs, like the one you compile. So, it is not possible to break at this time.

03 Jul 2012, 16:46

fantasia

Joined: 02 Jul 2012
Posts: 10

fantasia

I suppose what I really want to do is to be able to debug the (mis)loading of my DLL so that I might be able to figure out where I went wrong on my own.

The trouble is, in this case, that I'm relying on copying templates rather than understansing why the templates contain what they do. Hence, I haven't been able to understand why what I wrote (well, copied) was not being recognised as a DLL by Windows.

I'm a firm believer in trying to figure things out on my own, and I think that using a debugger is the best way to find out why code we write is not working the way we expected. However, I understand that the Ldr API contained within ntdll.dll, is doing the real work and I would like to debug it to see when it decides that my DLL is invalid.

But, I do also know when to ask for help from the community.

So, can anybody point me in the right direction as to how to go about debugging the loading of a DLL, and how to tell why Windows has decided that my DLL is invalid?

Thanks

04 Jul 2012, 09:59

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 17276
Location: In your JS exploiting you and your system

revolution

fantasia wrote:

... how to tell why Windows has decided that my DLL is invalid?

I mentioned this above:

Quote:

Your relocs section in the DLL will also be empty when you don't import any of the system APIs in the DLL. A DLL does not need to import any APIs but it must have a non-empty relocs section.

You will NEED to have proper relocs section. Three methods are:

create one normally with a functional DLL (not your basic test DLL above that has no requirement for relocs)
fake one with just "dd 8,0", or
make a dummy one with a false dependency upon something else

04 Jul 2012, 10:32

fantasia

Joined: 02 Jul 2012
Posts: 10

fantasia

@Revolution - I am grateful for, and have accepted your earlier advice.

Perhaps I am not making myself clear: I am trying to learn about DLLs and how they are validated and loaded by Windows. Because it allows fine-grained control of the format of the PE, FASM is the tool I am using to create both valid and invalid DLLs.

If all I ever see are examples of well-written, working DLLs , how am I going to know what's wrong with my rubbish ones?

So I don't want to just add lines to my source code until it works, I want to know:

Is there a way I can get Windows to tell me specifically what it didn't like about my DLL?

Thanks

04 Jul 2012, 11:03

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 17276
Location: In your JS exploiting you and your system

revolution

It might be possible to debug the loading of an invalid DLL if you delay the loading by using the LoadLibrary API (i.e. remove it from you import table), and use a debugger like OllyDbg. I've not tried it though so let us know if it works.

04 Jul 2012, 11:22

sinsi

Joined: 10 Aug 2007
Posts: 693
Location: Adelaide

sinsi

Doesn't windbg do kernel debugging?

Here's an old reference What Goes On Inside Windows 2000: Solving the Mysteries of the Loader

04 Jul 2012, 11:28

fantasia

Joined: 02 Jul 2012
Posts: 10

fantasia

@Revolution

That's an excellent idea, thank you. I will let you know how I get on.

04 Jul 2012, 11:28

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum