| Crates.io | rustdllproxy |
| lib.rs | rustdllproxy |
| version | 2.0.3 |
| created_at | 2025-04-21 18:12:39.439092+00 |
| updated_at | 2025-09-02 23:44:39.019472+00 |
| description | Crate to ease the development of proxy DLLs in Rust |
| homepage | |
| repository | https://github.com/JohnSwiftC/rustdllproxy |
| max_upload_size | |
| id | 1643060 |
| size | 26,067 |
cargo install rustdllproxy
There's a video tutorial available here.
Note: This video is now outdated. The process of writing functions remains the same, however the crate creation process and naming requirements have changed.
This crate currently only supports the standard DLL PE format. .NET DLLs are not supported.
This crate serves two main purposes:
Rustdllproxy generates a cdylib crate that compiles into a DLL.
rustdllproxy --help # See all available options
Tip: Use the
-pargument multiple times to unify several different DLLs into one proxy.
Before creating your crate, decide how the proxy DLL will interact with the original(s). A typical pattern is to append an underscore to the original DLL name.
⚠️ THIS MUST BE DONE BEFORE GENERATING THE CRATE - the generated .def file will reference this name for forwarding behavior.
Cargo Build Issue: Cargo will not rebuild if you change a
.deffile. Either force a rebuild or modifylib.rsto trigger recompilation.
The macro library supports 3 main hook types: prehook, posthook, and fullhook.
Replace the #[no_mangle] directive with the hook macro:
#[prehook("dllbeingproxied.dll", "function_name")]
Fill out the function signature (declare inputs as mut to modify them)
Update the generated .def file by removing forwarding behavior:
- function_name = dllbeingproxied.function_name @2
+ function_name @2
Build and deploy!
Remember: Force a full Cargo rebuild if you forget to update the
.deffile, as Cargo won't detect the change.
prehookExecutes code before the original function. Allows you to add functionality or modify input variables.
#[prehook("target.dll", "my_function")]
fn my_function(mut param1: i32, mut param2: &str) {
// Your code here - executes before original function
param1 *= 2; // Modify parameters if needed
}
posthookExecutes code after the original function. View and edit the return value using the magic ret variable.
#[posthook("target.dll", "calculate")]
fn calculate(input: i32) -> i32 {
// Original function executes first
// Then your code runs with access to 'ret'
ret = ret * 2; // Modify return value
}
Note: The
retvariable is automatically defined as mutable. You don't need to reference it if not needed.
fullhookProvides complete control over function execution. Manually manage the return value and function calling.
#[fullhook("target.dll", "do_multi_add")]
fn do_multi_add(mut a: i32, mut b: i32, mut c: i32) -> i32 {
// Pre-processing
a += 10;
b += 20;
// Call original function with magic func()
let mut return_value: i32 = func(a, b, c);
// Post-processing
return_value *= 2;
// Must explicitly return the value
return_value
}
Let's say you want to modify office.dll used in office software via DLL search order hijacking:
# Rename the original DLL
mv office.dll office_.dll
rustdllproxy -p office_.dll -o office_proxy
#[prehook("office_.dll", "open_window")]
fn open_window() {
// Your custom code here...
println!("Window is about to open!");
}
- open_window = office_.open_window @3
+ open_window @3
cargo build --release
# Rename the built DLL back to office.dll
# Place in the target directory
Important: Proxying several DLLs together is typically useful for reverse engineering and custom software development, not process modification.
When bundling multiple DLLs:
Contributions are welcome! Please feel free to submit issues and pull requests.