37

I'm trying to do exactly what LD_PRELOAD does, i.e. preload a shared library or DLL files on Windows to a given program to override certain functions.

Is there a LD_PRELOAD equivalent for Windows?

I don't have any specific functionalities in mind. I just know that this is possible on Linux, and I'm curious about how overloading a native DLL can be done on Windows.

4
  • 1
    What are you trying to accomplish? There is no direct equivalent Commented Jul 24, 2009 at 15:03
  • 1
    What functionality do you want to overload? Commented Jul 24, 2009 at 17:39
  • 1
    Also, is this for a .net managed assembly or for a native dll? Commented Jul 24, 2009 at 17:39
  • 3
    This is not possible, because the loading and symbol resolution are handled in a completely different way in GNU linker and PE loader. The closest you will get is to write what is sometimes called a "loader" in cracker circles, which implements either the debugger loop and thus can override some stuff when new modules/DLLs get loaded, or simply start the process with main thread suspended, then manipulate the import table or similar (in memory obviously) and then resume the main thread to enforce the modified behavior. Commented Mar 3, 2011 at 18:24

1 Answer 1

20

AppInit_DLLs.

http://support.microsoft.com/kb/197571

But see also:

AppInit_DLLs should be renamed Deadlock_Or_Crash_Randomly_DLLs

https://devblogs.microsoft.com/oldnewthing/20071213-00/?p=24183

You may also want to look into "DLL Injection". Four approaches (including AppInint_DLLs) are described here:

http://en.wikipedia.org/wiki/DLL_Injection

1

Not the answer you're looking for? Browse other questions tagged or ask your own question.