I am playing around with dll-hijacking and was wondering about something that I haven't been able to find out myself by googling. I get how the basics work with the fact that DLL's are loaded by an executeable/service/installer. I also understand how windows goes through the loading "path" to find the DLL's. So I can get my DLL's to execute calculator when I put my DLL in the path of the program itself when I know for sure it tries to find the DLL's in the path of the program.
But here is my question: How can I find out if a DLL is loaded by an executeable using a relative path?
What I want is to be able to execute that "not found" DLL from a directory in the PATH variable, so if I am just misunderstanding that, that would be possible please tell me as well.
I see that my question isn't a 100% clear by the comments/answers I am getting. So I will clarify a bit: I am just playing around so I have a testlab setup. What the question really is about is if there is any way to see if the DLL's that are loaded by an executable are loaded with a relative path and not by a absolute path. SO if the executable tries to just find test.dll or if it is refering to c:\windows\system32\test.dll. I am using procmon to see what DLL's are loaded by several applications (like Discord). In procmon I cannot see how the executable tries to find the DLL (relative or absolute path) and that is what I want to find out, how to see if the executable goes trough the different paths as described in this Link or if the executable is only trieing to load the absolute path of a dll.