取消全局CBT挂钩后，从所有进程中卸载DLL [英] Unloading DLL from all processes after unhooking global CBT hook

问题描述

当加载了DLL的系统范围的钩子卸载时，如何正确地从所有进程中卸载DLL?

How do you properly unload a DLL from all processes when the system-wide hook that loaded them gets unloaded?

来自 MSDN :

您可以释放全局钩子 通过使用程序 UnhookWindowsHookEx，但此功能 不会释放包含以下内容的DLL 挂钩程序.这是因为全球 钩子程序在 每个应用程序的处理上下文 在桌面上，导致隐式 调用LoadLibrary函数以用于 所有这些过程.因为有电话 FreeLibrary函数不能 为另一个过程而做 那么就没有办法释放DLL.这 系统最终在释放DLL之后 所有明确链接到 DLL已终止或已调用 FreeLibrary及其所有进程 所谓的钩子程序已经恢复 在DLL之外进行处理.

You can release a global hook procedure by using UnhookWindowsHookEx, but this function does not free the DLL containing the hook procedure. This is because global hook procedures are called in the process context of every application in the desktop, causing an implicit call to the LoadLibrary function for all of those processes. Because a call to the FreeLibrary function cannot be made for another process, there is then no way to free the DLL. The system eventually frees the DLL after all processes explicitly linked to the DLL have either terminated or called FreeLibrary and all processes that called the hook procedure have resumed processing outside the DLL.

所以我要寻找的是一种方法，该方法检测钩子何时被钩住，然后从所有被钩住的进程中调用FreeLibrary.钩子被卸载时，是否还有其他方法可以导致DLL的即时卸载?

So what I am looking for, is a method to detect when the hook is unhooked, and then call FreeLibrary from all the processes that were hooked. Are there any other ways to cause instant unloading of a DLL when the hook is unloaded?

推荐答案

挂钩dll在其消息循环中被卸载.强迫他们传递消息循环有助于卸载它们.

Hook dll are unloaded in their message loop. Forcing them to pass in the message loop help to unload them.

在UnhookWindowsHookEx之后添加此代码，以强制唤醒所有消息循环:

Add this after your UnhookWindowsHookEx to force all message loops to wake up :

DWORD dwResult;
SendMessageTimeout(HWND_BROADCAST, WM_NULL, 0, 0, SMTO_ABORTIFHUNG|SMTO_NOTIMEOUTIFNOTHUNG, 1000, &dwResult);

但是我仍然不时遇到这个问题.我不知道它从哪里来.我想锁定的进程可以阻止dll卸载，但是我没有任何证据.

However I still have the issue from time to time. I don't know where it's coming from. I suppose a locked process could prevent the dll to unload, but I have no proof of that.

这篇关于取消全局CBT挂钩后，从所有进程中卸载DLL的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！