Share via

Notification Hooks

  • Article

The notification hook is enabled:

  • By supplying a new definition of the pointer __pfnDliNotifyHook that is initialized to point to your own function that receives the notifications, or

  • By setting the pointer __pfnDliNotifyHook to the function before any calls to the DLL that the program is delay loading.

If this pointer is initialized (non-zero), the delay load helper will invoke the function at certain notification points throughout its execution. The function pointer has the following definition:

// The "notify hook" gets called for every call to the
// delay load helper. This allows a user to hook every call and
// skip the delay load helper entirely.
//
// dliNotify == {
//  dliStartProcessing |
//  dliPreLoadLibrary  |
//  dliPreGetProc |
//  dliNoteEndProcessing}
//  on this call.
//
#if defined(__cplusplus)
extern "C"
#endif
extern
PfnDliHook   __pfnDliNotifyHook;

The notifications pass in a DelayLoadInfo structure to the hook function along with the notification value. This data is identical to that used by the delay load helper routine. The notification value will be one of the values defined in Structure and Constant Definitions.