DllMain(DLL_PROCESS_DETACH) not called

[Vincent Fatica]

I can get Explorer to load (via LoadLibrary()) my DLL using VirtualAlloc(),
WriteProcessMemory(), and CreateRemoteThread() (a technique discussed here
occasionally). [Using the same technique, I can get Explorer to later use
FreeLibrary() to unload my DLL (at which time, DllMain is called with
DLL_PROCESS_DETACH).]

But I'd really like to jusy leave my DLL attached to Explorer until Explorer
terminates (typically logoff or shutdown). But I notice that
DllMain(DLL_PROCESS_DETACH) is not called when Explorer terminates after my
DLL has been loaded as described above.

Why isn't DllMain called with DLL_PROCESS_DETACH when Explorer terminates?

Thanks.

 

[Jochen Kalmbach [MVP]]

Hi Vincent!

Why isn't DllMain called with DLL_PROCESS_DETACH when Explorer terminates?

It depends on "how" the process was terminated.
If it was terminated using "TerminateProcess" then DLL_PROCESS_DETACH
will not be called.

<quote>
If you terminate a process by calling TerminateProcess or
TerminateJobObject, the DLLs of that process do not receive
DLL_PROCESS_DETACH notifications.
</quote>

Greetings
Jochen

 

[Vincent Fatica]

Hi Vincent!


It depends on "how" the process was terminated.
If it was terminated using "TerminateProcess" then DLL_PROCESS_DETACH
will not be called.

<quote>
If you terminate a process by calling TerminateProcess or
TerminateJobObject, the DLLs of that process do not receive
DLL_PROCESS_DETACH notifications.
</quote>

I am simply logging off. I would expect Explorer to be terminating
gracefully.