Reading @peter_ferrie's answer, this sounds a lot like the proxy DLL that I made once, so I'll add some details as to how I went about it.
I'll continue the naming scheme from peter's answer, so Z.DLL is the renamed original and A.DLL is your DLL (with Z.DLLs original name).
First, I ran
dumpbin /EXPORTS on the Z.DLL, resulting in a list of all exports of that DLL. I then wrote a script that took the list and generated a header file that contained one statement like this for each function Z.DLL exported:
#pragma comment(linker, "/export:[mangled_func_name]=[Z.DLL_name].[mangled_func],@[func_ordinal]")
These need to be mangled names, and the field [Z.DLL_name] shouldn't contain the file extension!
You should now be able to
include this header in your DLL and compile it. Put your A.DLL in the program's directory and you now have an "empty" proxy DLL. It only forwards the function calls through your A.DLL to the original Z.DLL for now though, which is thw work of these
To do something interesting, you need to
- find the mangled name of the function you want to replace
- run it through
undname to get the unmangled signature
- add a function with that signature to your A.DLL
- mark your function to be exported using e.g.
- delete the corresponding
#pragma in your header
Voilà! The program now calls your custom function in A.DLL while everything else is passed to Z.DLL.
If you need to call the original function, you should be able to do that using
GetProcAddress, but I haven't done this before.