TrainSec -
CyberSecurity ONLINE TRAINING ABOUT OUR INSTRUCTORS K N O W L E D G E L I B R A RY GET IN TOUCH S T U D E N T P O R TA L
online training
Knowledge library | Malware Analysis | Debugging DLL Files with IDA Disassembler
Debugging DLL Files with IDA
Disassembler
November 10, 2024
AUTHOR
Uriel
kosayev
Uriel Kosayev
Uriel Kosayev is a cybersecurity researcher, reverse engineer, and
author of MAoS and Antivirus Bypass Techniques. He’s led real-
world red team ops, malware investigations, and incident
response cases. As the founder of TrainSec Academy, he teaches
professionals to think like attackers and defend with precision. His
training is practical, focused, and based on real threats, not theory.
In this video, I’ll show you how to debug a DLL le with an IDA Disassembler. Many people nd debugging
DLL les challenging with IDA Pro and often prefer tools like x64dbg, which automatically imports and
executes the DLL. However, with IDA, the process is a bit different. Let’s explore how to do it.
Step 1: Determine DLL Bit Version
Before starting, identify whether the DLL le is 32-bit or 64-bit:
If the DLL is 64-bit, use the 64-bit version of IDA.
If the DLL is 32-bit, use the 32-bit version.
In this example, we’re using a 32-bit DLL.
Step 2: Load the DLL in IDA Pro
1. Launch IDA Disassembler.
2. Load the DLL le. In this example, your desired DLL (Emotet in this example).
3. Place a breakpoint at the prologue of the rst function.
4. Con rm that we’re in the DLL’s entry point. Check the exports of the DLL – in this case, there’s only
one export.
Step 3: Configure the Debugger in IDA
1. Select the Debugger: Choose “Local Windows Debugger” as the debugging environment.
2. Set Process Options:
Go to Debugger > Process Options.
Since DLL les don’t execute on their own and need a host executable to import and run their
functions, we need a process that can load the DLL.
$1408
$1128 or $113 X 10 payments
Windows
Security
Researcher
Provides the necessary knowledge,
understanding, and tools to be a
successful Windows OS researcher.
BECOME WINDOWS SECURITY
RESEARCHER
Step 4: Configure the Executable to Load the
DLL
1. Use [Link], a system executable capable of loading and executing functions from a DLL.
2. Path Con guration:
For a 32-bit DLL, use the 32-bit version of [Link], located in the C:\Windows\SysWOW64\
directory (even though the folder name can be confusing, it contains 32-bit system binaries).
Enter the path: C:\Windows\SysWOW64\[Link].
For a 64-bit DLL, use the 64-bit version of [Link], located in the C:\Windows\Systems32\
directory.
Enter the path: C:\Windows\System32\[Link].
3. Set Parameters:
Specify the DLL’s directory as the working directory.
For the parameters, include the DLL’s full path and add ,#1 to indicate the rst (and only)
export, the DLL entry point.
Step 5: Test and Debug
1. Run the Debugger: Execute the setup by clicking “Run.”
2. Verify the Breakpoint: You should hit the breakpoint set at the entry point, allowing you to debug
the DLL freely.
Thank you for watching!
This content is part of the Windows Security Researcher learning path.
Liked the content?
Subscribe to the free TrainSec knowledge library, and get insider access to new
content, discounts and additional materials.
ABOUT THE AUTHOR
Uriel
kosayev
Uriel Kosayev
Uriel Kosayev is a cybersecurity researcher, reverse engineer, and
author of MAoS and Antivirus Bypass Techniques. He’s led real-
world red team ops, malware investigations, and incident
response cases. As the founder of TrainSec Academy, he teaches
professionals to think like attackers and defend with precision. His
training is practical, focused, and based on real threats, not
theory.
A L L C O U R S E S A N D P U B L I C AT I O N S
Useful Resources Learning Paths Let's Connect
TrainSec -
Pavel’s GitHub Windows Master Developer Contact Us
CyberSecurity online
Pavel’s Books Windows Internals Master Join our Discord community
training
Antivirus Bypass Techniques Book Windows Security Researcher
Malware Analysis on Steroids Book Hardware Hacking Expert
SOC Analyst Professional –
Foundations
@2025 TrainSec. All rights reserved.
Terms of Use | Privacy Policy | Accessibility Statement