Hai,
I have a problem. Problem is: One process calls a dll by LoadLibrary after
it, process calls some methods of this dll. this dll calls another dlls(not
system dll) for executing methods. I have studied IAT ,proxy dll,
CreatRemoteThread hooking methods but i could not get help.
Please help me.
--
With regards
thanks
Anand Choubey

Re: dll hooking by Tim

Tim
Thu Apr 21 00:46:10 CDT 2005

"Anand Choubey" <AnandChoubey@discussions.microsoft.com> wrote:
>
>I have a problem. Problem is: One process calls a dll by LoadLibrary after
>it, process calls some methods of this dll. this dll calls another dlls(not
>system dll) for executing methods. I have studied IAT ,proxy dll,
>CreatRemoteThread hooking methods but i could not get help.
>Please help me.

Help you what? What's the problem?
--
- Tim Roberts, timr@probo.com
Providenza & Boekelheide, Inc

Re: dll hooking by Mike

Mike
Thu Apr 21 11:44:40 CDT 2005


"Tim Roberts" <timr@probo.com> wrote in message
news:jgfe61hktcfcvnrlpkto2jkbo2o0sr4enh@4ax.com...
> "Anand Choubey" <AnandChoubey@discussions.microsoft.com> wrote:
> >
> >I have a problem. Problem is: One process calls a dll by LoadLibrary
after
> >it, process calls some methods of this dll. this dll calls another
dlls(not
> >system dll) for executing methods. I have studied IAT ,proxy dll,
> >CreatRemoteThread hooking methods but i could not get help.
> >Please help me.
>
> Help you what? What's the problem?
> --
> - Tim Roberts, timr@probo.com
> Providenza & Boekelheide, Inc

I'm just guessing but I think that he's done some IAT hooking and now
LoadLibrary brings in a dll that uses some hooked methods. Or it loads more
dlls that need hooking. And the process can now call the methods, bypassing
the hooks. Maybe hooking LoadLibrary will help.

M



Re: dll hooking by Doug

Doug
Thu Apr 21 12:38:24 CDT 2005

On Thu, 21 Apr 2005 09:44:40 -0700, Mike P wrote:

> I'm just guessing but I think that he's done some IAT hooking and now
> LoadLibrary brings in a dll that uses some hooked methods. Or it loads more
> dlls that need hooking. And the process can now call the methods, bypassing
> the hooks. Maybe hooking LoadLibrary will help.
>
> M

Richter accounts for all that in "Programming Applications for Microsoft
Windows".

--
Doug Harrison
Microsoft MVP - Visual C++