Does anyone know how I can detect the load of a delay loaded DLL from my application? I want to put some hooks on a delay loaded dll but I can't do that unless I either a) inject the code after the dll is loaded, or b) detect when its loaded and apply the hooks accordingly.


Thanks.

Which language are you using?

If what you're saying is you want to know when a DLL is loaded using the LoadLibrary(A||W) function, you can do the following:

Inject a dll into the main process or start the process with this dll. 

When the DLL is loaded, use the detours library to setup a detour on the LoadLibrary call.

When your detour function executes, call the real LoadLibrary, and then install your hook into that dll.

The only possibly problem I see is that this solution won't catch dlls loaded before yours in the process.  If this is your application that you're trying to catch the call in, this won't be a problem as you won't need to inject a dll at all and can simply make sure the detour is installed first thing.

No, i'm talking about delay loaded DLL's with implicit linkage. e.g. winsock.dll won't be loaded until the program calls code provided by the DLL, then the loader will kick in and load the DLL. I haven't had time to look into it, but there's probably thunk in the IAT for all delay loaded imports that kickstarts the loader when it gets called to.