Search code examples
c++dlloverloadingdll-injectionoverriding

Overriding calls from kernel32

A executable file opens a file from the disk likely using CreateFileA

What I want to do is to override the call from kernel32.dll

and give the it stdin/stdout HANDLE

What I can do:

  • Give it my winmm.dll because it loads timeGetTime from it to get time

When I tried to override CreateFileA call in my DLL, the compiler just don't let me compile because kernel32.dll already have its reference

winmm.cpp(56): warning C4273: 'CreateFileA': inconsistent dll linkage
C:\Program Files (x86)\Windows Kits\8.1\Include\um\fileapi.h(122): note: see previous definition of 'CreateFileA'

Is there way to make the DLL I made to make it do that?

PS: I don't know much assembly but here is the disassembly when the program is scanning for the file I gave as parameter

enter image description here

enter image description here

Solution

  • You should try API hooking instead. Check out these links-

    https://www.apriorit.com/dev-blog/160-apihooks

    https://www.codeproject.com/Articles/2082/API-hooking-revealed