Windows® via C/C++, Fifth Edition

API Hooking: An Example

Injecting a DLL into a process’ address space is a wonderful way to determine what’s going on within a process. However, simply injecting a DLL doesn’t give you enough information. You’ll often want to know exactly how threads in a particular process are calling various functions, and you might want to modify what a Windows function does.

For example, I know of a company that produced a DLL that was loaded by a database product. The DLL’s job was to enhance and extend the capabilities of the database product. When the database product was terminated, the DLL received a DLL_PROCESS_DETACH notification and only then executed all of its cleanup code. The DLL would call functions in other DLLs to close socket connections, files, ...