I want to hook an export of user32.dll (used by MyProgram's Dependency MyProgram.dll)
My question is, Is the memory of every loaded DLL for a process and it's dependencies shared within a process?
or is "Copy on write" in effect? (XP/2000)
Lets say I have a program MyProgram.exe with a dependent dll I created --> MyDll.dll
IF I get the base address of USER32.DLL in MyProgram.exe and hook it. will it be hooked in the MyPrograml.dll's USER32.DLL dependency also? Since they are in the same process :confused:
Thank you... :alright:
My question is, Is the memory of every loaded DLL for a process and it's dependencies shared within a process?
or is "Copy on write" in effect? (XP/2000)
Lets say I have a program MyProgram.exe with a dependent dll I created --> MyDll.dll
IF I get the base address of USER32.DLL in MyProgram.exe and hook it. will it be hooked in the MyPrograml.dll's USER32.DLL dependency also? Since they are in the same process :confused:
Thank you... :alright:
not sure i follow you exactly..each windows system DLL like kernel and user have specialy allocated parts in your memory that is diffirent per OS. So if your hooking USER32.dll's base address it should certainly apply to any dll's your program is using, possibly even other processes if your hooker is setup this way
Uradox, not on NT - because of copy-on-write.
ah apollogies then :P
i am wrong
i am wrong
Uradox, not on NT - because of copy-on-write.
What exactly is copy-on-write?
It is a method that allows multiple processes to share the same physical memory for memory pages, and make a process-local copy when a page is modified. It's good for saving some memory - and this is one of the reasons that "using EXE packers is bad".
Uradox, not on NT - because of copy-on-write.
Is That a no f0dder???
No, they were talking about changes made in different processes. When a DLL is explicitly or implicitly loaded several times in the same process, only one instance is made, and a reference count is kept.