| 摘要 |
An application program includes an executable file and at least one other component (e.g. a DLL). A copy of the executable file is created and its import address table is modified by replacing a reference to the component with a reference to a delay-load component and replacing a reference to an imported function included within the component with a reference to a delay-load function included within the delay-load component. The delay-load function is designed to load the component into memory upon execution of a function call designed to access the imported function. The copy of the executable file may be saved as an alternate data stream of the original executable file. The copy of the executable file may be loaded into memory in response to a command for initializing the application program. As a result, the delay-load component will be loaded into memory instead of the component.
|
