Question

When i load dll in my process, how that dll resolve address of function that it imports ?
I tried to set breakpoint on GetProcAddress and LdrGetProcedureAddress but it doesnt break there.

Please someone explain.

Answer 1

When the DLL is loaded the loader will update all addresses if required to reflect the base address where the DLL is loaded.

http://msdn.microsoft.com/en-us/magazine/bb985014.aspx :

When creating a DLL, the linker assumes that the DLL will load at a
particular address. Certain pieces of the code and data contain
hardcoded addresses that are only correct if the DLL loads at the
preferred address. However, at runtime it’s possible that the
operating system may have to load the DLL at a different memory
location.

To handle the situation where the OS has to move the DLL, the linker
adds base relocations to the DLL. Base relocations are addresses that
require modification so that they contain the correct address for
where the DLL loaded in memory. The more base relocations a DLL has,
the more time the OS needs to process them and to load the DLL. A
properly based DLL loads at its preferred address, and can skip
processing the base relocation records.

It’s more common these days that a DLL’s base address is randomized as a security measure, the above article predates that. Also see:

Relocation (Wikipedia)

Portable Executable (Wikipedia)