CODEWITHSUNDEEP
cwindowsdlltrace
Giacomo Tesio
Giacomo Tesio

Reputation: 7210

How to intercept C library calls in windows?

I have a devilish-gui.exe, a devilish.dll and a devilish.h from a C codebase that has been lost.
devilish-gui is still used from the customer and it uses devilish.dll

devilish.h is poorly documented in a 30-pages pdf: it exposes a few C functions that behave in very different ways according to the values in the structs provided as arguments.

Now, I have to use devilish.dll to write a new devilish-webservice. No, I can't rewrite it.

The documentation is almost useless, but since I have devilish-gui.exe I'd like to write a different implementation of the devilish.h so that it log function's call and arguments in a file, and than calls the original dll function. Something similar to what ltrace does on linux, but specialized for this weird library.

How can I write such "intercepting" dll on windows and inject it between devilish.dll and devilish-gui.exe?

Upvotes: 2

Views: 1709

Answers (1)

Eric Brown
Eric Brown

Reputation: 13932

A couple of possibilities:

  1. Use Detours.
  2. If you put your implementation of devilish.dll in the same directory as devilish-gui.exe, and move the real implementation of devilish.dll into a subdirectory, Windows will load your implementation instead of the real one. Your implementation can then forward to the real one. I'm assuming that devilish-gui isn't hardened against search path attacks.
  3. Another approach would be to use IntelliTrace to collect a trace log of all the calls into devilish.dll.

Upvotes: 3

Related Questions