In Chapter 3, Dynamic Analysis, you learned how some DLLs can perform process checks to determine whether they are running under a particular process, such as explorer.exe or iexplore.exe. In that case, you may want to debug a DLL inside a specific host process, rather than rundll32.exe. To pause the execution at the DLL's entry point, you can either start a new instance of the host process or attach to the desired host process using the debugger, and then select Debugger | Debugger options and check the option Suspend on library load/unload. This option will tell the debugger to pause whenever a new module is loaded or unloaded. After these settings, you can resume the paused host process and let it run by pressing the F9 hotkey. You can now inject the DLL into the debugged host process with a tool like RemoteDLL. When the DLL is loaded by the host process, the debugger will pause, giving you a chance to set breakpoints in the address of the loaded module. You can get an idea of where the DLL has loaded into the memory by looking at the Segments window, as shown here:

In the preceding screenshot, you can see that the injected DLL (rasaut.dll) has loaded into the memory at the address 0x10000000 (the base address). You can set a breakpoint at the address of the entry point by adding the base address (0x10000000) with the value of the AddressOfEntryPoint field in the PE header. You can determine the value of the address of the entry point by loading the DLL into a tool such as pestudio or CFFexplorer. For example, if the AddressOfEntryPoint value is 0x1BFB, the DLL entry point can be determined by adding the base address (0x10000000) with the value 0x1BFB, which results in 0x10001BFB. You can now navigate to the address 0x10001BFB (or jump to the address by pressing the G key) and set a breakpoint at this address, and then resume the paused process.