if the dll is not in the list with its base in a process this is not a problem on softice
you can do these things :
1: you find a function what your target dll use (softice can set global beakpoints)
2: you break on dll main for your target dll (there a few ways solvings that)
3: since it injects the dll it maybe use CreateRemoteThread,WriteProcessMemory,SetWindowsHookEx you also can set global breakpoint on these functions and look their parameters
for CreateRemoteThread see that :
HANDLE WINAPI CreateRemoteThread(
__in HANDLE hProcess,
__in LPSECURITY_ATTRIBUTES lpThreadAttributes,
__in SIZE_T dwStackSize,
__in LPTHREAD_START_ROUTINE lpStartAddress,
__in LPVOID lpParameter,
__in DWORD dwCreationFlags,
__out LPDWORD lpThreadId
);
when this happens you look the lpStartAddress parameter this is where the thread will start in your target exe
you then switch target to your exe via "ADDR exename" and set a breakpoint on the address you founded
then you see where LoadLibrary happens what will return the base address where the dll is loaded
now you have a few options
1: you can freez and dump the dll with the information you got (useful info for you :softice also shows all dlls loaded with base + size just look the softice window(NTICE: Load32 START=7C000000 SIZE=14000 KPEB=849DBA20 MOD=notepad) )
as you see it comes with all information you need
you also should note that the prolly only the dll info is hidden the memory still exits
but as i sayed thats really not a problem on softice
2: you can scroll the dll manual or setting some breakpoints
ok well thats what came in my mind atm
btw i didnt exactly understand what you want to do ? do you want to unpack the dll ? do you want to gain information about the dll ? do you want to runtime debug it ?
