How to Transparently Intercept Procedure Calls in Windows

The information in this article applies to:

• Microsoft Windows Software Development Kit (SDK) for Windows versions 3.0 and 3.1

A technique for aliasing procedure names in Windows allows procedure calls to be transparently intercepted. You can use this technique to monitor activities such as checking arguments for validity.

To intercept procedure calls transparently, first build a Windows executable code library that resembles the following:

        HANDLE MyGlobalAlloc( flags, size )
        WORD  flags;
        DWORD size;
        {
            /* Perform any type of monitoring necessary here.

               if ( !size )
                   return 0;

            */
            return RealGlobalAlloc( flags, size );
        }

        HANDLE FAR PASCAL main( argc, argv )
        WORD argc;
        LPSTR argv;
        {
            return 1;
        }

   BOO.DEF:

   LIBRARY BOO
   DESCRIPTION "Procedure call interception library."
   DATA SINGLE MOVEABLE
   CODE MOVEABLE DISCARDABLE
   EXPORTS
          GlobalAlloc=MyGlobalAlloc
   IMPORTS
           RealGlobalAlloc=KERNEL.15

Build a dynamic link library (DLL) by running IMPLIB BOO.DEF as follows:

   IMPLIB BOO.DEF BOO.LIB

   link boo,,,mlibw mlibc,boo.def;

   link car,,,boo mlibw mlibc,car.def;