windbg: stepping into dll of a process - debugging

Question

Newb-question here. I have searched a couple days for the solution but dont't get anywhere. Using windbg preview.
There's a process that loads a dll and I want to see the disassembly of the addresses that are called from inside the dll. No symbols available because it is third party. I can find the entry point and break on it but after that I cannot step into the dll. I know I need to load the dll into windbg but I can't put it in the arguments when I start the exe because I only know the entry point after the module is loaded.
If I use .load on my dll and set a breakpoint on entry it doesn't work either.
Anyone done this before and can tell me what I need to do to step into the dll's assembly?
edit:
In windbg I launched the executable (.exe) and want to see the addresses and operations inside a .dll that are called during a specific operation in the program.

Answer 1

Simple things first: .load is for loading WinDbg Plugins into the WinDbg process. That's not what you want.
I'm assuming that you want to do more a reverse engineering than debugging. WinDbg is not ideal for this task. There are certainly better tools like IDA.
Analyzing without executing
But anyway, let's get into it. I'll choose an arbitrary DLL for this example. It is a DLL provided with the AMD display driver, C:\AMD\PSP Driver\WTx64\amdtee_api32.dll and I have no clue about it.
Open WinDbg Preview
Go to "Open dump file" (this is not really intuitive, but it will work)
In the file open dialog, enter *, so DLLs will be displayed (by default it's limited to DMP files)
Choose the DLL to be loaded
At this point, it will say
Microsoft (R) Windows Debugger Version 10.0.21349.1004 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\AMD\PSP Driver\WTx64\amdtee_api32.dll]
You can now operate on the DLL with the same commands as during a live debugging session.
0:000> lm
start end module name
10000000 10055000 amdtee_api32 (export symbols) amdtee_api32.dll
So I have no PDB file available, just export symbols, as there are:
0:000> x *!*
7ffe0300 SharedUserData!SystemCallStub = <no type information>
10001050 amdtee_api32!TEEC_InitializeContext (<no parameter info>)
[...]
And we can disassemble a function:
0:000> uf amdtee_api32!TEEC_InitializeContext
amdtee_api32!TEEC_InitializeContext:
10001050 55 push ebp
10001051 8bec mov ebp,esp
10001053 83ec08 sub esp,8
10001056 c745f801000000 mov dword ptr [ebp-8],1
1000105d 837d0c00 cmp dword ptr [ebp+0Ch],0
10001061 750a jne amdtee_api32!TEEC_InitializeContext+0x1d (1000106d) Branch
[...]
You can even access the memory where the DLL is loaded to
0:000> db amdtee_api32
10000000 4d 5a 90 00 03 00 00 00-04 00 00 00 ff ff 00 00 MZ..............
10000010 b8 00 00 00 00 00 00 00-40 00 00 00 00 00 00 00 ........#.......
10000020 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
10000030 00 00 00 00 00 00 00 00-00 00 00 00 10 01 00 00 ................
10000040 0e 1f ba 0e 00 b4 09 cd-21 b8 01 4c cd 21 54 68 ........!..L.!Th
10000050 69 73 20 70 72 6f 67 72-61 6d 20 63 61 6e 6e 6f is program canno
10000060 74 20 62 65 20 72 75 6e-20 69 6e 20 44 4f 53 20 t be run in DOS
10000070 6d 6f 64 65 2e 0d 0d 0a-24 00 00 00 00 00 00 00 mode....$.......