如何获取软件中发生的DLL加载通知（仅在我自己的进程中） [英] How to get notification of DLL loads happening in my software (inside my own process only)
问题描述
首先，一些背景：
我用VC ++编写的软件依赖于与我的应用一起加载的一些大型第三方DLL。这些库通常会在正常的操作过程中引发浮点异常，但是由于浮点控制字的默认配置来掩盖这些异常，因此不会因为这些异常而导致程序崩溃。
现在的问题是，当一些第三方程序（如 Zeallsoft超级屏幕捕获）注入自己的用Borland C ++编写的DLL时，他们设置FP Control Word允许浮点异常和我的应用程序崩溃因为这个。
虽然主要问题可能是与第三方lib和第三方软件注入它自己的Dll，我仍然希望保护我的软件不会因为这样的问题崩溃。
我可以想到的解决方案是一些如何获得Dll加载的通知在我的进程之内，并确保FP控制字在dll加载发生后重置为默认值。 p>
所以我正在寻找简单有效的方法来实现。有没有办法得到我的过程中发生的Dll负载的通知？有什么其他方式可以实现我想做的事吗？我唯一需要注意的是，该方法应该在Win 2K和WinXP和更高版本上工作，其次使用的方法不应该是可能触发防病毒/间谍软件扫描程序的恶意软件启发式的性质。 / p>
您可以使用Windows 调试器API ，具体来说，您要监视 LOAD_DLL_DEBUG_EVENT 调试事件。应该注意的是，调试自己是危险的，因为它可能导致应用程序锁定，这也意味着您无法正常调试。
替代方案是进行一个流程范围的热补丁（更好的论文）钩在 LoadLibraryEx ， LoadLibraryA 和 LoadLibraryW 并检查通过那里的dll。
这个问题的主要问题是您需要确保安装挂钩/ em> before 其他任何事情（你关心的）在进程加载中，这可能需要更多的黑魔法....
First of all, some background:
My software which is written in VC++ relies on some large third party DLL's that get loaded along with my app. These libs often raise Floating point exceptions during their normal course of operation, but they are not signaled as hardware exceptions because of the default configuration of Floating point Control word to mask these exceptions and hence the program does not crash because of these.
Now the issue is that when some third party programs like Zeallsoft Super Screen Capture inject their own DLLs which are written in Borland C++, they set the FP Control Word to enable the Floating point exceptions and my app crashes because of that.
While the main issue might be with the third party lib and the third party software that is injecting its own Dll's, I still want to protect my software from crashing because of such an issue.
The solution that I can think of is to some how get notification of Dll loads happening inside my process and ensure that the FP control word is reset to default value after the dll load happens.
So I am looking for simple and effective ways to achieve that. Is there some way to get notified of Dll loads happening in my process? Are there any other way of achieving what I want to do? The only thing that I want to be wary of is that the method should work on Win 2k and WinXP and higher and secondly the method used should not be of a nature that can potentially trigger the malware heuristics of Anti-virus/spyware scanners.
You can do this with the windows Debugger API, specifically you want to monitor the LOAD_DLL_DEBUG_EVENT debug event. it should be noted that debugging yourself is dangerous as it can lead to app locking, it also means you can't debug it normally.
the alternative is do a process-wide Hot Patch (a better paper on it) hook on LoadLibraryEx, LoadLibraryA and LoadLibraryW and check the dll's passing through there.
the main problem with this is you need to make sure you install the hooks/monitors before anything else (that you care about) in the process loads, which may require more 'black magic'....
这篇关于如何获取软件中发生的DLL加载通知（仅在我自己的进程中）的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
