I want to hook an export of user32.dll (used by MyProgram's Dependency MyProgram.dll)

My question is, Is the memory of every loaded DLL for a process and it's dependencies shared within a process?
or is "Copy on write" in effect? (XP/2000)

Lets say I have a program MyProgram.exe with a dependent dll I created --> MyDll.dll

IF I get the base address of USER32.DLL in MyProgram.exe and hook it. will it be hooked in the MyPrograml.dll's USER32.DLL dependency also? Since they are in the same process :confused:


Thank you... :alright:
Posted on 2004-08-13 03:11:25 by LarryH
not sure i follow you exactly..each windows system DLL like kernel and user have specialy allocated parts in your memory that is diffirent per OS. So if your hooking USER32.dll's base address it should certainly apply to any dll's your program is using, possibly even other processes if your hooker is setup this way
Posted on 2004-08-13 07:51:07 by Uradox
Uradox, not on NT - because of copy-on-write.
Posted on 2004-08-13 08:34:54 by f0dder
ah apollogies then :P
i am wrong
Posted on 2004-08-13 08:36:09 by Uradox

Uradox, not on NT - because of copy-on-write.


What exactly is copy-on-write?
Posted on 2004-08-13 14:15:36 by Mikky
It is a method that allows multiple processes to share the same physical memory for memory pages, and make a process-local copy when a page is modified. It's good for saving some memory - and this is one of the reasons that "using EXE packers is bad".
Posted on 2004-08-13 14:30:03 by f0dder

Uradox, not on NT - because of copy-on-write.


Is That a no f0dder???
Posted on 2004-08-13 15:46:25 by LarryH
No, they were talking about changes made in different processes. When a DLL is explicitly or implicitly loaded several times in the same process, only one instance is made, and a reference count is kept.
Posted on 2004-08-13 15:57:08 by Sephiroth3