hi,

how can i set a breakpoint (using olly) on the first instruction of a DllMain ?

the problem is, that LoadLibrary will call immediately the DllMain after the dll is mapped in the callers addressspace

is there a trick to accomplish that, or should i step through the whole LoadLibrary-function?

Put a mark in DEBUGGING OPTIONS-EVENTS- stop in module load- and when stop and look the name of dll you want in VIEW-EXECUTABLE, right click in this line and go to FOLLOW ENTRY with this you found the entry point, and you can put a BP o HE in Entry Point.

Ricardo Narvaja

damn, i love ollydbg
thxalot