Header File 

delayimp.h  

Category 

Delay load hook notification Routines 

Prototype 

typedef FARPROC (WINAPI *DelayedLoadHook)(dliNotification dliNotify, 

DelayLoadInfo * pdli); 

Description 

The delay load mechanism provides two hooks for you to modify the runtime behavior of a delay loaded DLL. By writing your own hook functions using the function signature below and assigning this to the two hooks you can modify the delay load process. 

DelayLoadProc structure 

typedef struct DelayLoadProc 

{ 

BOOL fImportByName; 

union 

{ 

LPCSTR szProcName; 

DWORD dwOrdinal; 

}; 

} DelayLoadProc; 

ImgDelayDescr structure 

typedef struct ImgDelayDescr 

{ 

DWORD grAttrs; /* attributes */ 

LPCSTR szName; /* pointer to dll name */ 

HMODULE hmod; /* address of module handle */ 

IMAGE_THUNK_DATA * pIAT; /* address of the IAT */ 

IMAGE_THUNK_DATA * pINT; /* address of the INT */ 

IMAGE_THUNK_DATA * pBoundIAT; /* address of the optional bound IAT */ 

IMAGE_THUNK_DATA * pUnloadIAT; /* address of optional copy of 

original IAT */ 

DWORD dwTimeStamp; /* 0 if not bound, */ 

/* O.W. date/time stamp of DLL bound 

to (Old BIND) */ 

} ImgDelayDescr; 

DelayLoadInfo structure 

typedef struct DelayLoadInfo 

{ 

DWORD cb; /* size of structure */ 

const ImgDelayDescr * pidd; /* raw form of data (everything is 

there) */ 

FARPROC * ppfn; /* points to address of function to 

load */ 

LPCSTR szDll; /* name of dll */ 

DelayLoadProc dlp; /* name or ordinal of procedure */ 

HMODULE hmodCur; /* the hInstance of the library we 

have loaded */ 

FARPROC pfnCur; /* the actual function that will be 

called */ 

DWORD dwLastError;/* error received (if an error 

notification) */ 

} DelayLoadInfo, *PDelayLoadInfo; 

Delay load import hook notifications 

The following structure is the enumerations that are defined for the hook notification events: 

typedef enum 

{ 

dliNoteStartProcessing, /* used to bypass or note helper only */ 

dliNotePreLoadLibrary, /* called just before LoadLibrary, can */ 

/* override w/ new HMODULE return val */ 

dliNotePreGetProcAddress, /* called just before GetProcAddress, can */ 

/* override w/ new FARPROC return value */ 

dliFailLoadLibrary, /* failed to load library, fix it by */ 

/* returning a valid HMODULE */ 

dliFailGetProcAddress, /* failed to get proc address, fix it by */ 

/* returning a valid FARPROC */ 

dliNoteEndProcessing, /* called after all processing is done, */ 

/* no bypass possible at this point */ 

/* except by longjmp(), throw(), or 

RaiseException. */ 

} dliNotification; 

Hook pointers 

The “notify hook” gets called for every call to the delay load helper. This allows a user to hook every call and skip the delay load helper entirely. 

extern DelayedLoadHook _EXPDATA __pfnDliNotifyHook; 

dliNotify == 

{ 

dliNoteStartProcessing | 

dliNotePreLoadLibrary | 

dliNotePreGetProcAddress | 

dliNoteEndProcessing 

}

extern DelayedLoadHook _EXPDATA __pfnDliFailureHook; 

This hook is called with the following notification flags: 

dliNotify == 

{ 

dliFailLoadLibrary | 

dliFailGetProcAddress 

} 

For further information on when this notify eventsd occur during the delay load process, please see delayhlp.c