Why LoadLibrary loads unrelated DLLs

2019-09-04 02:40发布

问题:

This is about DLL injection.

Let's say P.exe depends on A.dll, B.dll and C.dll (implicit linking), they're private modules of P.exe.

Now I use CreateProcess with CREATE_SUSPENDED flag to launch P.exe, after that I use CreateRemoteThread to call LoadLibrary in target process to load Inject.dll, and in the same way call an initialize function of Inject.dll to do real work (things you can't do in DLLMain).

It works. But I found that calling to LoadLibrary makes A.dll, B.dll and C.dll load too - not just Inject.dll. From the Output of Visual Studio, they even load before Inject.dll, this is not what I want. You know, Inject.dll does not depend on any third-party DLLs, in fact it just depends on kernel32.dll and user32.dll.

In this case, how to load only Inject.dll ?