Question

Currently, I have a C++ exe project, which dynamic load N DLLs.

Those DLLs will perform calling to the functions which is re-inside exe project.

Now, within my exe project, I wish to know the callers are coming from which DLLs.

Is it possible to do so using any available Windows API?

Answer 1

It depends on what your actual goal is. You cannot do it if you’re expecting the DLLs to be possibly malicious (that is, if you’re expecting them to try to trick you). But if it’s just for debugging or logging or something relaitvely harmless like that, you can look at the stack and get the address that the ret instruction will use to return to the caller, enumerate through the loaded DLLs and test which of them that address is inside of.

To get the “return address”, you can use the _ReturnAddress intrinsic in Visual C++, and then you can use the GetModuleHandleEx function, passing in GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS to get a handle to the DLL that the address is inside of.

But I must repeat: you cannot base security decisions off the results of this test. It is very easy for malicious code to fake and “trick” your program into thinking it’s a “trusted” or “safe” DLL. As I said, if it’s just for debugging or logging or something, then go right ahead.

Also, this will obviously only tell you the DLL the immediate caller is inside of. You can’t do it if you’re 5 levels deep or something….