Click here to Skip to main content
Click here to Skip to main content

Create your Proxy DLLs automatically

, 14 May 2007
Rate this:
Please Sign up or sign in to vote.
Here is a small program that will create the CPP and DEF for a proxy DLL, based on the exports of another DLL. You can use it to generate a template and then you edit this template to satisfy your needs.

Introduction

A lot of us have tried to create a proxy DLL to replace an existing one and spy other programs' calls. Here is a small program that will create the CPP and DEF for a proxy DLL based on the exports of another DLL. You can use it to generate a template and then edit this template to satisfy your needs.

Background

When creating a proxy DLL, you have to export precisely the same names as exported by the original DLL. This can be painful, for two reasons:

  1. There are too many exports.
  2. There are functions that you don't know what they do; you'd just want to spy on one specific function call.

The second problem is solved with assembly and with the aid of the __declspec(naked) attribute. The program creates function stubs that do nothing but JUMP (not call) to the exported address, so the stack is left as it should be. This allows you to create code only for functions that you actually know what they do.

Using the program

WRAPPIT <dll> <txt> <convention> <point dll name> <cpp> <def>  
  • <dll> is the new DLL name you want to create. The program can compile the DLL using VC++ or BC++, depending on how you comment or edit lines 233-237:
    //
    // _stprintf(ay,_T("BCC32 -o%s.obj -c %s\r\n"),argv[5],argv[5]);
    _stprintf(ay,_T("CL.EXE /O2 /GL /I \".\" /D \"WIN32\" /D \"NDEBUG\" /D" 
              "\"_WINDOWS\" /D \"_WINDLL\" /FD /EHsc /MT /Fo\".\\%s.obj\" " 
              "/Fd\".\\vc80.pdb\" /W3 /nologo /c /Wp64 /TP " 
              "/errorReport:prompt %s\r\n"),argv[5],argv[5]);
    system(ay);
    // _stprintf(ay,_T("ILINK32 -c -Tpd %s.obj,
    //           %s,,,%s\r\n"),argv[5],argv[1],argv[6]);
    _stprintf(ay,_T("LINK.EXE /OUT:\"%s\" /INCREMENTAL:NO /NOLOGO /DLL" 
              " /MANIFEST /DEF:\"%s\" /SUBSYSTEM:WINDOWS /OPT:REF " 
              "/OPT:ICF /LTCG /MACHINE:X86 /ERRORREPORT:PROMPT " 
              "%s.obj kernel32.lib user32.lib gdi32.lib winspool.lib " 
              "comdlg32.lib advapi32.lib shell32.lib ole32.lib " 
              "oleaut32.lib uuid.lib odbc32.lib odbccp32.lib\r\n"), 
              argv[1],argv[6],argv[5]);
    system(ay);
    //
  • <txt> is a text file containing the exports from the original DLL. You can create this file with either dumpbin:
    dumpbin /exports original.dll > exports.txt

    or with tdump:

    tdump original.dll -ee > exports.txt
  • <convention> is the convention call you want your functions to have. You will usually want to use __stdcall, but it hardly matters what you use because the stub functions immediately jump to the existing code and therefore, they should work with any calling convention.
  • <point dll name> is the DLL name that your proxy DLL will try to load. Make sure you use C++ escape characters like \\.
  • <cpp> is the generated CPP file.
  • <def> is the generated DEF file.

Example:

You have WSOCK32.DLL and you want to create a proxy for it, replacing the original DLL as WSOCK32_.DLL. What would you do?

  • move wsock32.dll wsock32_.dll
  • dumpbin /exports wsock32_.dll > exports.txt
  • wrappit wsock32.dll exports.txt __stdcall .\\wsock32_.dll wsock32.cpp wsock32.def

This will:

  • Parse the text file for exports and create the DEF. Exported functions by ordinal only are supported.
  • Create the sample CPP code. In the DLL's code DllMain, the original wsock32_dll will be loaded with LoadLibrary(). Then all the original exported functions' addresses will be returned by GetProcAddress and stored in an internal pointer. Then stubs for each function will be created.

A single CPP will look like this:

//
#include <windows.h>
#pragma pack(1)
HINSTANCE hLThis = 0;
HINSTANCE hL = 0;
FARPROC p[75] = {0};
// -----------
BOOL WINAPI DllMain(HINSTANCE hInst,DWORD reason,LPVOID)
{
    if (reason == DLL_PROCESS_ATTACH)
    {
        hLThis = hInst;
        hL = LoadLibrary(".\\wsock32_.dll");
        if (!hL) return false;

        p[0] = GetProcAddress(hL,"AcceptEx");
        p[1] = GetProcAddress(hL,"EnumProtocolsA");
        p[2] = GetProcAddress(hL,"EnumProtocolsW");
      ...
    }
    if (reason == DLL_PROCESS_DETACH)
    {
        FreeLibrary(hL);
    }
    return 1;
}

// AcceptEx
extern "C" __declspec(naked) void __stdcall __E__0__()
{
    __asm
    {
        jmp p[0*4];
    }
}

// EnumProtocolsA
extern "C" __declspec(naked) void __stdcall __E__1__()
{
    __asm
    {
        jmp p[1*4];
    }
}

// EnumProtocolsW
extern "C" __declspec(naked) void __stdcall __E__2__()
{
    __asm
    {
        jmp p[2*4];
    }
}
...
//

A single DEF will look like this:

EXPORTS
AcceptEx=__E__0__ @1141
EnumProtocolsA=__E__1__ @1111
EnumProtocolsW=__E__2__ @1112
...

You may now edit CPP/DEF files and reuse them to create your own proxy DLL!

Important!

Once the cpp is ready, you should replace functions that you know how to use. For example, If you want to spy on Wsock32.send():

// send, created by wrappit
extern "C" __declspec(naked) void __stdcall __E__69__()
   {
   __asm
    {
    jmp p[69*4];
    }
 }

// If you want to manipulate it, change to:
extern "C" int __stdcall __E__69__(SOCKET x,char* b,int l,int pr)
  {
  // manipulate here parameters

.....
  // call original send
     typedef int (__stdcall *pS)(SOCKET,char*,int,int);
     pS pps = (pS)p[63*4];
     int rv = pps(x,b,l,pr);

     return rv;
  }

History

  • 14 May, 2007 - Fixed problem occuring when dumpbin.exe generates RVA information as well

License

This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here

Share

About the Author

Michael Chourdakis
Engineer
Greece Greece
I'm working in C++, PHP , Flash and DSP Programming, currently experimenting with Windows 7 technologies and professional audio applications.
 
I 've a PhD in Digital Signal Processing.
 
My home page: http://www.michaelchourdakis.com

Comments and Discussions

 
Questionmangled named containing @ PinmemberMember 107546257-May-14 5:16 
AnswerRe: mangled named containing @ Pinmemberafterwhoru8-May-14 3:22 
QuestionD3D9.DLL - Direct3DCreate9 no return(?) PinmemberTom Burbeck14-Jan-14 12:56 
AnswerRe: D3D9.DLL - Direct3DCreate9 no return(?) PinmemberTom Burbeck14-Jan-14 14:08 
QuestionCan anyone upload wrappit2? PinmemberLowlife123421-Aug-13 8:03 
AnswerRe: Can anyone upload wrappit2? PinmemberMichael Chourdakis21-Aug-13 22:56 
Questionare there mistakes in the example usage? Pinmemberyoels1-Jun-12 20:40 
AnswerRe: are there mistakes in the example usage? PinmemberMichael Chourdakis1-Jun-12 22:52 
QuestionAccess violation error Pinmembernksung5-Dec-11 20:04 
Questionwrappit2 generates 2 def files Pinmemberkevincw0120-Oct-11 10:18 
AnswerRe: wrappit2 generates 2 def files PinmemberMichael Chourdakis21-Oct-11 5:34 
GeneralMy vote of 5 PinmemberAshley Davis25-Sep-11 18:15 
GeneralNice work PinmemberZeko7829-Mar-11 0:33 
GeneralError Pinmemberdeusprogrammer18-Feb-11 17:03 
GeneralWrappit2 url, again PinmemberOneMarko11-Feb-11 5:44 
GeneralRe: Wrappit2 url, again PinmemberMichael Chourdakis12-Feb-11 1:36 
GeneralWrappit 2.0 url PinmemberMichael Chourdakis28-Aug-10 21:08 
QuestionProblems replacing output parameters of ReadFile() PinmemberMember 341291712-Jul-10 22:08 
AnswerRe: Problems replacing output parameters of ReadFile() PinmemberMichael Chourdakis13-Jul-10 1:41 
GeneralRe: Problems replacing output parameters of ReadFile() PinmemberMember 341291713-Jul-10 9:23 
GeneralNot working... Pinmemberjogibear998816-May-10 11:39 
Generalbug in wrappit Pinmembermeir livneh13-May-10 14:42 
General(naked) attribute not supported on x64 Pinmembermeir livneh13-May-10 14:40 
GeneralSome functions not formal !! PinmemberFarvashan7-Apr-10 10:18 
Questionwhy p[x*4] ? PinmemberdaDotr19-Dec-09 7:11 
GeneralExports having a ordinal number only Pinmemberspackjarrow9-Dec-09 10:53 
GeneralI cant make it work for ws2_32.dll PinmemberMugiwara27-Jul-09 4:44 
GeneralRe: I cant make it work for ws2_32.dll PinmemberArielMendoza27-Jul-09 21:29 
GeneralRe: I cant make it work for ws2_32.dll PinmemberMugiwara28-Jul-09 6:03 
GeneralRe: I cant make it work for ws2_32.dll PinmemberArielMendoza28-Jul-09 9:59 
GeneralRe: I cant make it work for ws2_32.dll [modified] PinmemberMugiwara29-Jul-09 2:24 
GeneralRe: I cant make it work for ws2_32.dll PinmemberArielMendoza29-Jul-09 10:40 
GeneralNew application PinmemberArielMendoza27-Jul-09 0:34 
GeneralError in the index PinmemberCodeGibbon3-Dec-08 1:58 
GeneralForwarding function PinmembersparrowIsaBird22-Oct-08 13:12 
GeneralRe: Forwarding function PinmemberMichael Chourdakis22-Oct-08 20:32 
GeneralRe: Forwarding function PinmembersparrowIsaBird22-Oct-08 23:25 
GeneralCant create exports.txt :'( PinmemberMember 434391915-Jan-08 7:00 
GeneralRe: Cant create exports.txt :'( PinmemberMichael Chourdakis15-Jan-08 8:25 
GeneralRelease of Wrappit 2.0 PinmemberMichael Chourdakis16-Dec-07 7:14 
GeneralRe: Release of Wrappit 2.0 PinmemberHernán Di Pietro17-Sep-08 18:36 
GeneralRe: Release of Wrappit 2.0 Pinmemberndataman21-Oct-08 5:18 
GeneralRe: Release of Wrappit 2.0 PinmemberMichael Chourdakis21-Oct-08 5:28 
GeneralRe: Release of Wrappit 2.0 Pinmemberndataman22-Oct-08 0:18 
GeneralRe: Release of Wrappit 2.0 Pinmembertop_sli14-Feb-10 12:31 
QuestionHow to make it work with WinCE? [modified] PinmemberKelvin Foo Chuan Lyi10-Sep-07 16:00 
AnswerRe: How to make it work with WinCE? PinmemberMichael Chourdakis10-Sep-07 17:15 
GeneralRe: How to make it work with WinCE? PinmemberKelvin Foo Chuan Lyi14-Sep-07 5:02 
GeneralRe: How to make it work with WinCE? PinmemberMichael Chourdakis14-Sep-07 5:10 
GeneralRe: How to make it work with WinCE? PinmemberMichael Chourdakis14-Sep-07 6:08 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Mobile
Web01 | 2.8.141029.1 | Last Updated 14 May 2007
Article Copyright 2006 by Michael Chourdakis
Everything else Copyright © CodeProject, 1999-2014
Terms of Service
Layout: fixed | fluid