Override any function in DLL

[ngoctrongda]

My friend made MATH.ddl in which has a function named SUM(int x, int y) (I just khow the function and its parameters, I don't know the entails code in it). On a nice day, I want to override the function SUM(x,y) of my friend (not make a new dll), just to hide my friend function by my function SUM(x,y) ver 2.0 (^ ^).How can I do that?

[email protected]

[Igor Vartanov]

just to hide my friend function by my function

Once exported function never can be hidden in dll. To override it you must place between app and dll an additional proxy dll, which would passthrough every call to target dll except particular ones to be overridden. Your app must be linked with proxy dll rather than with target dll made by friend.

Another way is to change app to call different function (SUM_ instead of SUM) implemented somewhere else.

The best way is to design application properly and never get stable and to-be-overridden functions assembled into solid module. Use plugins.

[Roger Allen]

You could use one of the methods outlines here:

http://www.devx.com/Intel/Article/21023/2046

Persoinally, I have used the InterceptApi, which can be used for any type of DLL not just system ones.

[ngoctrongda]

To override it you must place between app and dll an additional proxy dll, which would passthrough every call to target dll except particular ones to be overridden. Your app must be linked with proxy dll rather than with target dll made by friend.

Another way is to change app to call different function (SUM_ instead of SUM) implemented somewhere else.

The best way is to design application properly and never get stable and to-be-overridden functions assembled into solid module. Use plugins.[/QUOTE]

[ngoctrongda]

To override it you must place between app and dll an additional proxy dll, which would passthrough every call to target dll except particular ones to be overridden. Your app must be linked with proxy dll rather than with target dll made by friend.

Another way is to change app to call different function (SUM_ instead of SUM) implemented somewhere else.

The best way is to design application properly and never get stable and to-be-overridden functions assembled into solid module. Use plugins.

I'm grateful to you but can you tell me more about that. It's good if you send me the source and demo project to descibe how to "Override ...DLL".
Thank you very much.
my@: [email protected]

[Igor Vartanov]

It's good if you send me the source and demo project to descibe how to "Override ...DLL".

OK, I describe the most complex method - masking export with proxy.

In archive you can find six source files:

target.cpp and target.def make target.dll with four export entries - Func1, Func2, Func3 and Func4. All of them pop up the message box reading "Target DLL" in caption. When you see such caption you can be aware function was called from target.dll.

proxy.cpp and proxy.def make proxy.dll, which exports four functions but implements only a single Func3 overridden one. All the rest are passthrown to original target.dll (see three pragmas with "/export").

Both clients (clnt_target.cpp and clnt_proxy.cpp) demonstrate difference in usage between original dll and proxy dll. Target client links to target.dll directly, hence you'll see "Target DLL" in all message captions. But proxy client will show "Target DLL" in first, second and the last messages, but "Proxy DLL" in third one.

There's one subtle thing to be comprehended absolutely: why proxy dll exports _Func1, _Func2 and _Func4 names instead of Func1, Func2 and Func4.

The reason of this is hidden in the fact that all those exports are made artificially, therefore exported names must be corresponded to internal compiler names, which are anticipated by linker when it looks into .lib to resolve func names used in client module. Since Func1 was declared as

extern "C" void Func1();

it looks for symbol _Func1. If Func1 would be declared as

void Func1();

linker would search symbol ?Func1@@YAXXZ, therefore proxy dll should export ?Func1@@YAXXZ symbol - exactly what linker is searching for.

As you can understand, there would be too many combinations in export conditions in real project - so you have to resolve them yourself.

[ngoctrongda]

Thank to Igor Vartanov
I've just follow your guide
But I think I'm not intelligent enough to do that. So I still have not solve the problem.
By the way, thanks very much

[ngoctrongda]

I had one: Ma.dll
In Ma.dll, I have 4 func:
int Func1() // good func
int Func2() // normal func
int Func3() // bad func
==> I want to override Func3(). If you can override func3 , show me your source and demo project.
PS: I poss Ma.dll for you to override

[Igor Vartanov]

So I still have not solve the problem.

Well, then you can use function interception technique suggested by Roger.

[ngoctrongda]

Thank Igor. I've done it when I follow your guide.
But I still have a problem:
InterceptAPI() method must have the TARGET.OBJ. It's unreal because all I have is TARGET.DLL (sonmeone give me) and I must override Func3() in TARGET.DLL.
Do you have any way to solve this problem?
Remember: You only have a TARGET.DLL.

[Igor Vartanov]

InterceptAPI() method must have the TARGET.OBJ.

Target import library (target.lib), you mean.

It's unreal because all I have is TARGET.DLL (sonmeone give me) and I must override Func3() in TARGET.DLL.

Well, how are you going to use it? Who biulds final exe, which uses that dll? Ain't it you? Solution will depend on method dll functions are finally linked - implicitely or explicitly.

And I've got some doubts - what is your end task? To use dll with some function substituted? Or modify that dll for further usage by another person?

[ngoctrongda]

Yeah,...I did it .Thank to Roger Allen's link
Oke, I'll tell you my end task.
I'm do my project in my university. It's all.
Now, everything seems OK.
Thank to Igor.
One thing, I don't know how you to optimize the code in the Roger's Link. It's fantastic. From now, I myself will research the code in that link.
PS: I will ask you when I'm not enough IQ.(^_^)

[ngoctrongda]

I tried your guide for my project but it not work.
Can you look at it for a moment?

[Igor Vartanov]

In OverrideMa3.cpp you have to declare

int Func3();

instead of extern "C" int Func3();. Function declaration shoud absolutely correspond one in ma.dll. after that all works fine.

[ngoctrongda]

Oke. I get it.Thank you.
Why don't you need these following codes in your BOOL INTERCEPTAPI(..)? They say we must know the offset before we use INTERCEPT method. Why???

// Change the protection of the trampoline region
// so that we can overwrite the first 5 + offset bytes.
VirtualProtect((void *) dwTrampoline, 5+offset, PAGE_WRITECOPY, &dwOldProtect);
for (i=0;i<offset;i++)
*pbTrampoline++ = *pbTargetCode++;
pbTargetCode = (BYTE *) dwAddressToIntercept;

// Insert unconditional jump in the trampoline.
*pbTrampoline++ = 0xE9; // jump rel32
*((signed int *)(pbTrampoline)) = (pbTargetCode+offset) - (pbTrampoline + 4);
VirtualProtect((void *) dwTrampoline, 5+offset, PAGE_EXECUTE, &dwOldProtect);