C / C++ / MFC

Richard MacCutchan1-Aug-12 7:03

Richard MacCutchan

1-Aug-12 7:03

I think you actually did all the work, but happy to add my little bit.

One of these days I'm going to think of a really clever signature.

Member 41945931-Aug-12 9:24

Member 4194593

1-Aug-12 9:24

Richard II,

I had found this once before from some on-line source, and that is how I initially set my paths. I could not remember how to do this later. There is no documentation in the Windows 7 Help files about how to modify an environment variable. There are so many different ways to do things in Windows 7 than in Windows XP, and very little documentation on how to do it.

My next problem is how to get the MSDN documentation for Visual Studio 2008. I tried to install it from the CD, but it failed to install. I need to find out how to get a new CD or to download it from MS, but I do not want to have to pay for any MSDN subscription.

Thank you for all the help.

Dave.

Richard MacCutchan1-Aug-12 21:29

Richard MacCutchan

1-Aug-12 21:29

Member 4194593 wrote:
I do not want to have to pay for any MSDN subscription.

I manage with the MSDN online site[^], which, once you get used to it, is not too difficult to navigate, or search.

One of these days I'm going to think of a really clever signature.

Member 41945932-Aug-12 6:22

Member 4194593

2-Aug-12 6:22

Richard,

I guess I will have to use that site also. Wish that it had an alphabetical organization instead of a topic organization. At least search gets you the api if you know what to search for.

Dave.

The third way to load Dynamic-Link Libraries?

Member 419459331-Jul-12 7:37

Member 4194593

31-Jul-12 7:37

Richard II,

Well, Yahoo is back, I am off to go down the rabbit hole called MS Feedback. I may find my way out of there.

Dave.

Falconapollo29-Jul-12 4:58

Falconapollo

29-Jul-12 4:58

A DLL can be loaded explicitly by using LoadLibrary and GetProcAddress functions (sometimes called "run-time linking" or "manual linking") or implicitly by linking so called import library into your program and declaring functions in conventional way (sometimes called "load-time linking" or "automatic linking"). The latter method has two varieties: pre-load and delay-load. Pre-loaded DLLs are loaded instantly and unconditionally at the start of the program. Delay-loaded DLLs are loaded when (if) they are first used.

So, in this terms, there are still only two major ways to load a DLL: explicit and implicit. The latter load method just happens to have two sub-varieties. Some people might prefer to interpret this hierarchical classification as a flat one, ending up with three linking/loading methods.

Some companies ask the other ways to load Dynamic-Link Libraries(besieds explict and implict) in their interview.

But I wonder whether exists other ways to load the Dynamic-Link Libraries?

Any help will be appreciated!

modified 29-Jul-12 20:40pm.

Richard Andrew x6429-Jul-12 6:06

29-Jul-12 6:06

Wow, that's a tough question. I suppose you could try to load it from memory by manually mapping the sections into memory and resolving all the imports. But that's really a hack, and it's very difficult to handle every case the way the Windows Loader does.

The difficult we do right away...
...the impossible takes slightly longer.

pasztorpisti29-Jul-12 7:51

29-Jul-12 7:51

I wrote such piece of code and its surprisingly short. It has many drawbacks you might not spot at first sight but here is a list that came to my mind from the time I played with this: some module related features won't work because your DLL doesn't have a valid windows HMODULE/HINSTANCE handle, so you can't easily use for example resources, your library wont receive DLL_THREAD_ATTACH/DETACH events, you have to write your own GetProcAddress(). You can also use Resources (for examaple dialogs) if you write your own FindResource() and you use CreateDialogIndirect() instead of CreateDialog(), lot of resources have an "indirect" version fortunately. To sum it up: its pain in the ass to load your library "manually" but its fun to experiment with it, and it can hide a "hack" very well in the process space. With this load method you can skip loading the DLL PE header that makes thing harder to detect even for memory sweeps, thats why we used it.

Richard Andrew x6429-Jul-12 8:08

29-Jul-12 8:08

I'm honored to meet someone who actually implemented this. I once looked into it and I was totally intimidated.

Your list of features that won't work is precisely why I didn't pursue it.

But maybe when I have more time I would experiment with it......

The difficult we do right away...
...the impossible takes slightly longer.

pasztorpisti29-Jul-12 8:20

29-Jul-12 8:20

Just looked up my sources and Iam thinking about posting up the sources here. I have a similar module hacking related short tip/trick whose rating is almost a 5. For this reason I think that some people might be interested in this stuff but Iam lazy to write a full fledged article. What about posting up a few tips with short intro + sources? For example one for the FindResource, and another with the Dll loading.

Richard Andrew x6429-Jul-12 8:22

29-Jul-12 8:22

pasztorpisti wrote:
What about posting up a few tips with short intro + sources?

I would vote that a 5 many times over.

The difficult we do right away...
...the impossible takes slightly longer.

pasztorpisti29-Jul-12 8:28

29-Jul-12 8:28

OK, then I post the sources as tips, it will serve well for PE divers at least as a tutorial or reference. Its easier to find out things even by debugging this code then starting from zero. Big Grin | :-D

pasztorpisti29-Jul-12 12:51

29-Jul-12 12:51

I don't know if you have permission to view articles before they are accepted and put into published from pending but I send the links and you can make a try:
Manual DLL loading.[^]
Custom FindResource()[^]

Richard Andrew x6429-Jul-12 13:06

29-Jul-12 13:06

Thanks! Unfortunately I'm not one of the chosen ones. I'll have to wait til it's approved, I'm afraid.

The difficult we do right away...
...the impossible takes slightly longer.

pasztorpisti29-Jul-12 13:07

29-Jul-12 13:07

OK, will repost it when its done!

pasztorpisti30-Jul-12 4:31

30-Jul-12 4:31

The tips are published! Here you go:
Loading Win32 DLLs "manually" without LoadLibrary()[^]
The inner working of FindResource() and LoadString() Win32 functions.[^]
However I guess not too many ppl are interested in this stuff, especially because they don't know why have these solutions born. Smile | :)

Richard Andrew x6430-Jul-12 6:07

30-Jul-12 6:07

Great!

The difficult we do right away...
...the impossible takes slightly longer.

jschell29-Jul-12 6:49

jschell

29-Jul-12 6:49

Falconapollo wrote:
Some companies ask the other ways to load Dynamic-Link Libraries(besieds explict and implict) in their interview.
But I wonder whether exists other ways to load the Dynamic-Link Libraries?

Excluding evidence to the contrary I would say that you covered all of the possibilities.

Have you considered the possibility that those "companies" (presumably actually certain individuals) are wrong? Did they explain their answer to you so perhaps you could paraphrase what they said?

Falconapollo29-Jul-12 14:17

Falconapollo

29-Jul-12 14:17

Maybe you are right.

How about the DLL Injection and API Hooking which is mentioned in Chapter 22,

C++

Windows via C/C++, Fifth Edition

by Jeffrey Richter and Christophe Nasarre?

It seems another way to use dll.

But I'm not sure.

Richard Andrew x6429-Jul-12 18:18