Start vs WinMain()

Question

I am trying to analyze a malicious DLL and when I loaded it in IDA, I can see two functions - DLLEntryPoint and DLLMain. I then proceeded to change the format by switching the characteristics bit that identified the file as a DLL to an EXE. When I load the file again in IDA, I can see two functions - Start and WinMain

From what I understand, Start is the entry point for an exe and it does some initialization before it calls WinMain or Main. Are DLLEntryPoint and DLLMain similar functions for Dlls?

Answer 1

First, please read this.

Essentially the difference is (in both cases) that one - the entry point - refers to the address where the initial code will be located and the other - "main function" - will be the one provided by the (C) runtime, potentially hiding gory details from you.

From what I understand, Start is the entry point for an exe and it does some initialization before it calls WinMain or Main. Are DLLEntryPoint and DLLMain similar functions for Dlls?

This is almost correct. Start is the symbolic name of the entry point in this case, true. However, whether it performs some kind of initialization depends entirely on the library. I wager IDA has recognized some runtime library (such as the Visual C++ runtime) by way of a FLIRT signature and used that information to point out DllMain to you.

Conceptually DLLEntryPoint and DLLMain mirror what you found for .exe files, yes.