intercepting DLL

Posted on 1998-01-29
Last Modified: 2013-12-03
I want my program  execute and application and
then intercept all DLL calls it sends/receives.

How can I do that?
Question by:jct052097
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
  • 2
  • +1
LVL 22

Expert Comment

ID: 1410620
you probably (realisically) can't.

The only way I can see to do it would be to modify the EXE's  import jump table.  You would have to change each entry to point to a procedure of yours that does the monitoring and then jumps to the original procedure.  The jump table is read only, however, you can get arround it somehow.  (I know this because debugers get arround it somehow.)

Expert Comment

ID: 1410621
nope, neitod, you can.

Matt Pietrek wrote an article a long while back in the Microsoft Systems Journal about a program called APISPY32 that intercepts API calls. It's somewhere in the back issues of MSJ on MSDN, but I think it's in the 1995 issues.

LVL 15

Expert Comment

by:Tommy Hui
ID: 1410622
The answer is yes and no.

If you are doing this in Win16, you can find out where the DLL is located using LoadLibrary() and for each exported function, overwrite the first 5 bytes of the function to a JMP xxxx where xxxx is your DLL's function, and this will work for every application because this is how Win16 works.

However, if you want this behavior in Win32, you basically can't. You can do it for a single application because you can write a debugger (as nietod suggested). This is basically what Matt's article is about. However, this may or may not be the behavior you're interested in.

If you really want to do this for every single application, you can write a replacement DLL and rename the OS's DLL and make sure your DLL has the same name. Then internally, you can use LoadLibrary to load the renamed OS's DLL and call that through GetProcAddress(). This is clunky and almost always require a reboot because there may already be an application using that DLL to begin with.

Revamp Your Training Process

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action.


Author Comment

ID: 1410623
I wanted to say DDE, not DLL.
I have two programs that communicate each other
by DDE (I think; is there any other way?).

And I would like to monitor them, and
if possible, change the info.

LVL 15

Expert Comment

by:Tommy Hui
ID: 1410624
Then that's easy. When you use DdeInitialize(), you can use the APPCLASS_MONITOR flag to specify that you want to monitor all DDE messages.

LVL 22

Expert Comment

ID: 1410625
That explains your weird terminology.  I though sending/receiving calls was a little unusual.

Author Comment

ID: 1410626

 Please, can you explain me it a little more?
I never have programmed DDE applications.

Just tell me how to start or give a simple example.
I'll grade you.

LVL 15

Accepted Solution

Tommy Hui earned 50 total points
ID: 1410627
You should then get a book on DDE programming. Basically you register a callback function with DDE that it should receive messages much like a WndProc. You should take a look at the online help for DdeInitialize() and use the APPCLASS_MONITOR flag.


Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
error email attachment VB2010 5 54
Slow process to read Excel 15 148
Delphi Mdi application Child forms get behind control 7 312
WPF issue with Trigger 2 130
If you have ever found yourself doing a repetitive action with the mouse and keyboard, and if you have even a little programming experience, there is a good chance that you can use a text editor to whip together a sort of macro to automate the proce…
After several hours of googling I could not gather any information on this topic. There are several ways of controlling the USB port connected to any storage device. The best example of that is by changing the registry value of "HKEY_LOCAL_MACHINE\S…
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA.…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question