Hooking dll loading

[Hologram]

Hi all,

I am thinking if it's possible to know when some application is trying to load a dll and do some effects before it loads

e.g. user launch application and it is going to load dll, i want to catch it and instead of loading default dll, load my own dll

is it possible without editing application's exe file?

Thanks in advance.

[OpsMan]

Originally posted by Hologram@Jul 29 2006, 09:18 PM
Hi all,

I am thinking if it's possible to know when some application is trying to load a dll and do some effects before it loads

e.g. user launch application and it is going to load dll, i want to catch it and instead of loading default dll, load my own dll

is it possible without editing application's exe file?

Thanks in advance.
1515



Ok...google "dll+hooking".. that's a good place to start. Probably what you're looking for or you can try "Hooking Windows Messages". These are both valid techniques for accomplishing your goal.

[fileoffset]

Usually the best way to force your dll to load is to either write a wrapper for it or simply overwrite it, by either overwriting the original .dll itself, or by using the same filename but in a directory with higher search priority.

Writing a custom wrapper around a dll (if its a 1 time job) isn't hard either, you could do something like this:

rename original.dll to backup.dll
put your new original.dll in same directory

your new original.dll would have same exports, that simply run your code, then redirect to newly named backup.dll

[paradox]

First off sorry for posting in an old thread but this may help some one code there dll "wrapper"...

first of all i wouldnt call it a dll wrapper, this source is really DLL forwarding.

the friendly people at microsoft have made it very easy to do dll export forwarding.


now cm3.dll ( the dll from cruddme3 ) has 4 exports, named Serialone to SerialFour as seen below

sample code:

CM3.ASM Export Forwarding Source:
---------------------------------------------------------START OF FILE CM3.ASM -----------------------------------------------

.386
.model flat,stdcall
option casemap:none

include \masm32\include\windows.inc
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc
includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib

.data
GoodGuy db "Dll Forwarding is fun.",0

.code
DllEntry proc hInstDLL:HINSTANCE, reason:DWORD, reserved1:DWORD ;our dll main, called when the dll is
mov eax,TRUE ;loaded
ret
DllEntry Endp

SerialOne proc
invoke SetWindowText,dword ptr [ebp+8], offset GoodGuy ; replacement proc for SerialOne, its called instead of the
ret ; real cm3.dll code
SerialOne endp

SerialTwo proc ; dumbie proc, this is actually passed off to the real cm3.dll
SerialTwo endp ; that we have renamed cm3o.dll

SerialThree proc ;dumbie proc, again passed off.
SerialThree endp

SerialFour proc ; replacement for SerialFour in cm3.dll ( renamed cm3o.dll)
ret
SerialFour endp

End DllEntry ; end our dll

---------------------------------------------------------END OF FILE CM3.ASM -----------------------------------------------



nothing really special is going on in there, so your asking how microsoft makes it so easy ? the answer is in the .def ....

---------------------------------------------------------START OF FILE CM3.DEF -----------------------------------------------

LIBRARY CM3 ; name of our library
EXPORTS SerialOne ; one of the functions it exports
EXPORTS SerialTwo=CM3O.SerialTwo ; heres where the magic starts, we renamed the real cm3.dll to cm3o
EXPORTS SerialThree=CM3O.SerialThree ; and as you can see all you have to do is tell the assembler that serialthree is
EXPORTS SerialFour ; actually just a foreward to another dll, in our case CM3O

---------------------------------------------------------END OF FILE CM3.DEF -----------------------------------------------

anyways i hope this helps some of you.