Solved

intercepting DLL

Posted on 1998-01-29
8
310 Views
Last Modified: 2013-12-03
I want my program  execute and application and
then intercept all DLL calls it sends/receives.

How can I do that?
0
Comment
Question by:jct052097
  • 3
  • 2
  • 2
  • +1
8 Comments
 
LVL 22

Expert Comment

by:nietod
ID: 1410620
you probably (realisically) can't.

The only way I can see to do it would be to modify the EXE's  import jump table.  You would have to change each entry to point to a procedure of yours that does the monitoring and then jumps to the original procedure.  The jump table is read only, however, you can get arround it somehow.  (I know this because debugers get arround it somehow.)
0
 
LVL 2

Expert Comment

by:anichini
ID: 1410621
nope, neitod, you can.

Matt Pietrek wrote an article a long while back in the Microsoft Systems Journal about a program called APISPY32 that intercepts API calls. It's somewhere in the back issues of MSJ on MSDN, but I think it's in the 1995 issues.

0
 
LVL 15

Expert Comment

by:Tommy Hui
ID: 1410622
The answer is yes and no.

If you are doing this in Win16, you can find out where the DLL is located using LoadLibrary() and for each exported function, overwrite the first 5 bytes of the function to a JMP xxxx where xxxx is your DLL's function, and this will work for every application because this is how Win16 works.

However, if you want this behavior in Win32, you basically can't. You can do it for a single application because you can write a debugger (as nietod suggested). This is basically what Matt's article is about. However, this may or may not be the behavior you're interested in.

If you really want to do this for every single application, you can write a replacement DLL and rename the OS's DLL and make sure your DLL has the same name. Then internally, you can use LoadLibrary to load the renamed OS's DLL and call that through GetProcAddress(). This is clunky and almost always require a reboot because there may already be an application using that DLL to begin with.

0
 
LVL 1

Author Comment

by:jct052097
ID: 1410623
sorry!!!
I wanted to say DDE, not DLL.
I have two programs that communicate each other
by DDE (I think; is there any other way?).

And I would like to monitor them, and
if possible, change the info.



0
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

 
LVL 15

Expert Comment

by:Tommy Hui
ID: 1410624
Then that's easy. When you use DdeInitialize(), you can use the APPCLASS_MONITOR flag to specify that you want to monitor all DDE messages.


0
 
LVL 22

Expert Comment

by:nietod
ID: 1410625
That explains your weird terminology.  I though sending/receiving calls was a little unusual.
0
 
LVL 1

Author Comment

by:jct052097
ID: 1410626
thui,

 Please, can you explain me it a little more?
I never have programmed DDE applications.

Just tell me how to start or give a simple example.
I'll grade you.

0
 
LVL 15

Accepted Solution

by:
Tommy Hui earned 50 total points
ID: 1410627
You should then get a book on DDE programming. Basically you register a callback function with DDE that it should receive messages much like a WndProc. You should take a look at the online help for DdeInitialize() and use the APPCLASS_MONITOR flag.


0

Featured Post

Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

Join & Write a Comment

What my article will show is if you ever had to do processing to a listbox without being able to just select all the items in it. My software Visual Studio 2008 crystal report v11 My issue was I wanted to add crystal report to a form and show…
Entering time in Microsoft Access can be difficult. An input mask often bothers users more than helping them and won't catch all typing errors. This article shows how to create a textbox for 24-hour time input with full validation politely catching …
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now