Search code examples
windowsdllhookdll-injection

How to identify what calls are made to a DLL?

I want to hook into a DLL library and manipulate the arguments passed into it and manipulate its behavior. I don't want to have to maintain a separate fork by rebuilding the library and tracking changes. Instead, I want to use my library as a way to just pass calls on to the target library.

I can see what functions are exposed in the DLL but I only need to implement a subset of these. Is there a way to use a debugger to monitor and get a list of functions being called?

Solution

  • What you want to make a is a proxy DLL. You replace the original DLL with yours and rename the original, then you LoadLibrary() the original renamed DLL. For functions you don't want to log or modify, you just pass through to the real DLL function. Otherwise you modify the arguments and then pass it through.

    There are many tools which can help you generate a proxy DLL