DllMain(DLL_PROCESS_DETACH) not called

  • Thread starter Thread starter Vincent Fatica
  • Start date Start date
V

Vincent Fatica

I can get Explorer to load (via LoadLibrary()) my DLL using VirtualAlloc(),
WriteProcessMemory(), and CreateRemoteThread() (a technique discussed here
occasionally). [Using the same technique, I can get Explorer to later use
FreeLibrary() to unload my DLL (at which time, DllMain is called with
DLL_PROCESS_DETACH).]

But I'd really like to jusy leave my DLL attached to Explorer until Explorer
terminates (typically logoff or shutdown). But I notice that
DllMain(DLL_PROCESS_DETACH) is not called when Explorer terminates after my
DLL has been loaded as described above.

Why isn't DllMain called with DLL_PROCESS_DETACH when Explorer terminates?

Thanks.
 
Hi Vincent!
Why isn't DllMain called with DLL_PROCESS_DETACH when Explorer terminates?
Click to expand...

It depends on "how" the process was terminated.
If it was terminated using "TerminateProcess" then DLL_PROCESS_DETACH
will not be called.

<quote>
If you terminate a process by calling TerminateProcess or
TerminateJobObject, the DLLs of that process do not receive
DLL_PROCESS_DETACH notifications.
</quote>

Greetings
Jochen
 
Hi Vincent!


It depends on "how" the process was terminated.
If it was terminated using "TerminateProcess" then DLL_PROCESS_DETACH
will not be called.

<quote>
If you terminate a process by calling TerminateProcess or
TerminateJobObject, the DLLs of that process do not receive
DLL_PROCESS_DETACH notifications.
</quote>
Click to expand...

I am simply logging off. I would expect Explorer to be terminating
gracefully.
 
Back
Top