ntdll.dll中的哪个例程负责调度已加载dll的DllMain函数？

#1 楼

使用windbg，您可以设置一个sxe ld：Modname事件中断

，如果您正在运行此中断，则会弹出打印机的帮助gui

rundll32.exe printui.dll PrintUIEntry /?

如果要中断此printUI.dll的CrtMain或AddressOfEntryPoint，可以像这样

C:\WINDOWS\system32>cdb rundll32.exe printui.dll PrintUIEntry /?

Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
ntdll!LdrpDoDebuggerBreak+0x30:
00007ffc`b725121c cc              int     3

0:000> sxe ld:printui.dll    
0:000> .sxcmds
sxe ld:printui.dll ;

0:000> g
ModLoad: 00007ffc`a04e0000 00007ffc`a058d000   C:\WINDOWS\system32\printui.dll
ntdll!NtMapViewOfSection+0x14:
00007ffc`b721c5c4 c3              ret

0:000> .lastevent
Last event: 1d84.293c: Load module C:\WINDOWS\system32\printui.dll at 00007ffc`a04e0000
  debugger time: Mon May 25 23:55:59.235 2020 

0:000> .shell -ci "!dh 00007ffc`a04e0000" findstr /I Entry
    3CA0 address of entry point
.shell: Process exited

0:000> bp 00007ffc`a04e0000+3ca0
0:000> bl
 0 e 00007ffc`a04e3ca0     0001 (0001)  0:**** printui!DllMainCRTStartup
0:000> g
ModLoad: 00007ffc`b5950000 00007ffc`b59f3000   C:\WINDOWS\System32\ADVAPI32.dll
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Breakpoint 0 hit
printui!DllMainCRTStartup:
00007ffc`a04e3ca0 48895c2408 mov qwordptr[rsp+8],rbx ss:0000009a`5918edd0=0000000000000000

进行操作，然后可以看到调用堆栈以查找所有负责的调用导致此中断的原因

0:000> k
Child-SP          RetAddr           Call Site
0000009a`5918edc8 00007ffc`b71a50a1 printui!DllMainCRTStartup
0000009a`5918edd0 00007ffc`b71e9405 ntdll!LdrpCallInitRoutine+0x65
0000009a`5918ee40 00007ffc`b71e91f8 ntdll!LdrpInitializeNode+0x1b1
0000009a`5918ef80 00007ffc`b71aaa97 ntdll!LdrpInitializeGraphRecurse+0x80
0000009a`5918efc0 00007ffc`b71a2591 ntdll!LdrpPrepareModuleForExecution+0xbf
0000009a`5918f000 00007ffc`b71a22a8 ntdll!LdrpLoadDllInternal+0x199
0000009a`5918f080 00007ffc`b71a1764 ntdll!LdrpLoadDll+0xa8
0000009a`5918f230 00007ffc`b43e56f0 ntdll!LdrLoadDll+0xe4
0000009a`5918f320 00007ff7`ff62356e KERNELBASE!LoadLibraryExW+0x170
0000009a`5918f390 00007ff7`ff623aff rundll32!_InitCommandInfo+0x82
0000009a`5918f7e0 00007ff7`ff6262d9 rundll32!wWinMain+0x1ef
0000009a`5918fa50 00007ffc`b6287bd4 rundll32!__wmainCRTStartup+0x1c9
0000009a`5918fb10 00007ffc`b71eced1 KERNEL32!BaseThreadInitThunk+0x14
0000009a`5918fb40 00000000`00000000 ntdll!RtlUserThreadStart+0x21