The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,860 other subscribers

DLL call forwarding: learned something new today!

Posted by jpluimers on 2013/11/28

Learned something new today:

the effect of a DLL forwarder. The code for the function Ds­Address­To­Site­NameW doesn’t live in netapi32.dll. Instead, netapi32.dll has an export table entry that says “If anybody comes to me asking for Ds­Address­To­Site­NameW, send them to logoncli!Ds­Address­To­Site­NameW instead.”

–jeroen

via: If you can’t find the function, find the caller and see what the caller jumps to – The Old New Thing – Site Home – MSDN Blogs.

Leave a comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.