NewLC - Intercept calls to the file system - Comments

Intercept calls to the file system

didster — Fri, 28 Jan 2005 10:12:48 +0100

You could monkey with the files import table at runtime, as most Win32 API intercepters do. But you'll always going to be faced with a problem of injecting your DLL into the process in order to do this - on Win32, they use hooks, which work since the OS does the injection for you.

The only other thing I could suggest would be to write a "loader" app which loads your app, then botches the import table. This is how may cracks ahem etc work.

Your problem is mad worse though since (most) user "programs" arn't EXEs, they are DLLs.

Good luck

Intercepting system calls

Anonymous — Fri, 28 Jan 2005 10:03:37 +0100

But we can't replace or rename efsrv.dll as it's placed in ROM (on the phone ). Do you have any other solution?

Thanks and regards
Anu

Intercept calls to the file system

didster — Fri, 28 Jan 2005 08:52:03 +0100

Why?

It is possiable yes. Is it easy? No.

You would need to create a stub DLL to replace efsrv.dll. This dll would need the exact same exports as the real efsrv.dll (in the exact same order). Then you would call this dll efsrv.dll. The original dll, you would rename and link to from your stub. In your stub, you forward the calls onto the real DLL.

Intercept calls to the file system

AnuB — Fri, 28 Jan 2005 07:10:10 +0100