The following diagram depicts the MCISpy application implementation model. The stub or proxy DLL replaces the true MDM.DLL, which is renamed to MCI.DLL. The proxy MDM exports the same APIs at the same ordinals as the true MDM. The proxy MDM has forwarder entries into the MCI.DLL for the API workers. That is, the proxy exports and also imports the same APIs from the true MDM.
┌────────────────┐ │ Shared Memory │ │ (Named) │ ├────────────────┤ ┌──────────────┐ Exported APIs │ │ │ True MDM │ │ Stub or │ │ containing │ mciSendCommand() │ Proxy │ Forwarder entry │ the API │ ─────────────────┤ MDM.DLL ├────────────────────>┤ workers is │ mciSendString() │ │ Forwarder entry │ renamed to │ ─────────────────┤ Maintain Open ├────────────────────>┤ MCI.DLL. │ mdmDriverNotify()│ Device Ids │ Forwarder entry │ │ ─────────────────┤ ├────────────────────>┤ │ │ Notify Spy │ │ │ │ Application │ │ │ └────────────────┘ └──────────────┘ ┌────────────────┐ │ Shared Memory │ │ (Named) │ ├────────────────┤ │ MCISpy │ │ Sample Program │ └────────────────┘