interposers on Windows

Question

Is it possible to substitute system functions, as is possible on Linux and Solaris using the LD_PRELOAD

For example by setting the environment variable: LD_PRELOAD=/path

Answer 1

Microsoft Research has a library called Detours which allows you to intercept Win32 API calls.

Detours is a library for instrumenting arbitrary Win32 functions on x86, x64, and IA64 machines. Detours intercepts Win32 functions by re-writing the in-memory code for target functions. The Detours package also contains utilities to attach arbitrary DLLs and data segments (called payloads) to any Win32 binary.

Answer 2

If Detours ( as mentioned previously ) is not an option - then you might take a look at WinAPI Override. It is actively mantained. Note that only 32 bit version is available.