Why LoadLibrary loads unrelated DLLs

纵饮孤独 提交于 2019-12-12 01:20:27

问题


This is about DLL injection.

Let's say P.exe depends on A.dll, B.dll and C.dll (implicit linking), they're private modules of P.exe.

Now I use CreateProcess with CREATE_SUSPENDED flag to launch P.exe, after that I use CreateRemoteThread to call LoadLibrary in target process to load Inject.dll, and in the same way call an initialize function of Inject.dll to do real work (things you can't do in DLLMain).

It works. But I found that calling to LoadLibrary makes A.dll, B.dll and C.dll load too - not just Inject.dll. From the Output of Visual Studio, they even load before Inject.dll, this is not what I want. You know, Inject.dll does not depend on any third-party DLLs, in fact it just depends on kernel32.dll and user32.dll.

In this case, how to load only Inject.dll ?

来源:https://stackoverflow.com/questions/30557950/why-loadlibrary-loads-unrelated-dlls

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!