__pfnDliNotifyHook, __pfnDliFailureHook

Go Up to delayimp.h Index

Header File

delayimp.h

Category

Delay load hook notification Routines

Prototype

typedef FARPROC (WINAPI *DelayedLoadHook)(dliNotification dliNotify,
     DelayLoadInfo * pdli);

Description

The delay load mechanism provides two hooks for you to modify the runtime behavior of a delay loaded DLL. By writing your own hook functions using the function signature below and assigning this to the two hooks you can modify the delay load process.

DelayLoadProc structure

typedef struct DelayLoadProc
 {
  BOOL fImportByName;
  union
    {
       LPCSTR szProcName;
       DWORD dwOrdinal;
    };
  } DelayLoadProc;

ImgDelayDescr structure

typedef struct ImgDelayDescr
 {
   DWORD grAttrs; /* attributes */
   LPCSTR szName; /* pointer to dll name */
   HMODULE hmod; /* address of module handle */
   IMAGE_THUNK_DATA * pIAT; /* address of the IAT */
   IMAGE_THUNK_DATA * pINT; /* address of the INT */
   IMAGE_THUNK_DATA * pBoundIAT; /* address of the optional bound IAT */
   IMAGE_THUNK_DATA * pUnloadIAT; /* address of optional copy of original IAT */
   DWORD dwTimeStamp; /* 0 if not bound, */
                      /* O.W. date/time stamp of DLL bound to (Old BIND) */
  } ImgDelayDescr;

DelayLoadInfo structure

typedef struct DelayLoadInfo
 {
   DWORD cb; /* size of structure */
   const ImgDelayDescr * pidd; /* raw form of data (everything is there) */
   FARPROC * ppfn; /* points to address of function to load */
   LPCSTR szDll; /* name of dll */
   DelayLoadProc dlp; /* name or ordinal of procedure */
   HMODULE hmodCur; /* the hInstance of the library we have loaded */
   FARPROC pfnCur; /* the actual function that will be called */
   DWORD dwLastError;/* error received (if an error notification) */
  } DelayLoadInfo, *PDelayLoadInfo;

Delay load import hook notifications

The following structure is the enumerations that are defined for the hook notification events:

typedef enum
 {
   dliNoteStartProcessing, /* used to bypass or note helper only */
   dliNotePreLoadLibrary, /* called just before LoadLibrary, can */
                          /* override w/ new HMODULE return val */
   dliNotePreGetProcAddress, /* called just before GetProcAddress, can */
                             /* override w/ new FARPROC return value */
    dliFailLoadLibrary,  /* failed to load library, fix it by */
                         /* returning a valid HMODULE */
    dliFailGetProcAddress, /* failed to get proc address, fix it by */
                           /* returning a valid FARPROC */
    dliNoteEndProcessing,  /* called after all processing is done, */
                           /* no bypass possible at this point */
                           /* except by longjmp(), throw(), or RaiseException. */
  } dliNotification;

Hook pointers

The "notify hook" gets called for every call to the delay load helper. This allows a user to hook every call and skip the delay load helper entirely.

extern DelayedLoadHook _EXPDATA __pfnDliNotifyHook;
dliNotify ==
  {
    dliNoteStartProcessing |
    dliNotePreLoadLibrary |
    dliNotePreGetProcAddress |
    dliNoteEndProcessing
   }

Note: The "failure" hook is assigned to:

extern DelayedLoadHook _EXPDATA __pfnDliFailureHook;

This hook is called with the following notification flags:

dliNotify == 
 {
  dliFailLoadLibrary |
  dliFailGetProcAddress
 }

For further information on when this notify eventsd occur during the delay load process, please see delayhlp.c