I have written a C API with support for static import hooking via overwriting the corresponding IAT entry of an exported function. It works nicely for older simple applications, but for more modern applications, it is less effective. This is primarily due to the large amount of applications nowadays that dynamically import functions.
My solution to this problem was to create the process in an initial suspended state and then hook the LoadLibrary(Ex)(A/W)
family of functions along with GetProcAddress()
to replace the retrieved address of a target function with my own. That solution is limited in part due to the fact that it is based off the application only importing dynamic functions and libraries in the executable module, without working for processes created later ( although that could be solved by hooking CreateProcess()
) or more importantly, it doesn't handle the DLLs in the application that also call the target functions I want to hook. This is obviously because the DLLs have a separate import section in their own PE from the executable module.
Which brings me to my question, how do I hook the entry point of a DLL? I want to implement that method because I need the DLL to be bound to the libraries it imports statically, so I can hook the LoadLibrary/GetProcAddress functions in before the DLL has a chance to load/import them in DLLMain. I'm assuming there is a way to do this by changing the entry point of the DLL, or by hooking a lower level function that handles calling a DLL entry point in kernel32.dll.
If the method I'm requesting has a better alternative, then I would gladly accept that solution as well if it achieves my desired effect.
My processor is an AMD Athlon II X2 250 that is x86-x64 compatible, and my operating system is Windows 7.