DLL call forwarding: learned something new today!
Posted by jpluimers on 2013/11/28
Learned something new today:
the effect of a DLL forwarder. The code for the function DsAddressToSiteNameW doesn’t live in netapi32.dll. Instead, netapi32.dll has an export table entry that says “If anybody comes to me asking for DsAddressToSiteNameW, send them to logoncli!DsAddressToSiteNameW instead.”
–jeroen
Leave a Reply