What's the principle of LOADDLL.EXE?

Question

It can be used to run arbitary Dynamic Link Library in windows,

how can it possibly know the entry point of an arbitary dll?

Answer 1

The answer depends on how much details you need. Basically, it comes down to this:

A DLL can optionally specify an entry-point function. If present, the system calls the entry-point function whenever a process or thread loads or unloads the DLL.

[...] If you are providing your own entry-point, see the DllMain function. The name DllMain is a placeholder for a user-defined function. You must specify the actual name you use when you build your DLL.

(Taken from the MSDN article Dynamic-Link Library Entry-Point Function.)

So basically, the entry point can be specified inside the DLL, and the operating system's DLL loader knows how to look this up.

Answer 2

The IMAGE_OPTIONAL_HEADER (part of the portable executable's header on Windows machines) contains an RVA of the AddressOfEntryPoint that is called by programs looking for an entry point to call (e.g., the loader).

More information on the IMAGE_OPTIONAL_HEADER can be found here. And this paper is good for just general PE knowledge.

Answer 3

What do you mean by "run a DLL"? DLLs aren't normal programs, they are just a collection of functions. The entry point itself usually doesn't do much apart from initializing stuff required by other functions in the DLL. The entry point is automatically called when the DLL is loaded (you can use LoadLibrary to do this).

If you want to call a specific function after loading the DLL, you can use GetProcAddress to get a pointer to the function you want.