none
DllMain

    Question

  • Hello everyone,


    From MSDN,

    http://msdn2.microsoft.com/en-us/library/ms682583.aspx

    parameter fdwReason of DllMain has four values,

    DLL_PROCESS_ATTACH
    DLL_PROCESS_DETACH
    DLL_THREAD_ATTACH
    DLL_THREAD_DETACH

    I think we could simply understand what MSDN described about the four values in the following way after some experiment (I have read the big table and want to extract some brief and simple information to understand to remember),

    DLL_PROCESS_ATTACH: will be called only once when the process loads the DLL for the 1st time
    DLL_PROCESS_DETACH: will be called only once when the process unloads the DLL (when process stops)
    DLL_THREAD_ATTACH: will be called every time when a thread inside the current process loads the DLL
    DLL_THREAD_DETACH: will be called every time when a thread inside the current process unloads the DLL

    Is that correct understanding?


    thanks in advance,
    George

    Friday, October 19, 2007 7:00 AM

Answers

  •  George2 wrote:

    Thanks Ramkrishna,

     

    I am confused about what do you mean *just a notification of new thread creation/activation*. Support the host process is creating a new thread, you mean whether or not the thread will utilize the DLL, the DllMain will be invoked with parameter DLL_THREAD_ATTACH or DLL_THREAD_DETACH?

     

    If I do not understand your points correctly, could you provide some simple pseudo code please?

     

     Ramkrishna Pawar wrote:

    Correct for DLL_PROCESS_*  but not for DLL_THREAD_ATTACH is not called when your DLL is loaded by that thread, usually all the DLLs loaded in that process are available for all the threads running in that process. So DLL_THREAD_ATTACH is just a notification of new thread creation/activation, same for DLL_THREAD_DETACH.

     

     

    regards,

    George

    Yes, when new thread is created DLLMain is called for reason DLL_THREAD_ATTACH.

     

    Here is quote from MSDN,

     

    DLL_THREAD_ATTACH

    The current process is creating a new thread. When this occurs, the system calls the entry-point function of all DLLs currently attached to the process. The call is made in the context of the new thread. DLLs can use this opportunity to initialize a TLS slot for the thread. A thread calling the DLL entry-point function with DLL_PROCESS_ATTACH does not call the DLL entry-point function with DLL_THREAD_ATTACH.

    Note that a DLL's entry-point function is called with this value only by threads created after the DLL is loaded by the process. When a DLL is loaded using LoadLibrary, existing threads do not call the entry-point function of the newly loaded DLL.

    Friday, October 19, 2007 10:07 AM
  •  George2 wrote:
    It is interesting and after reading MSDN reference, I think each time a new thread is created, DllMain will be invoked (as callback function) with DLL_THREAD_ATTACH value (support DLL is loaded before creating thread) -- even if the thread does not use the DLL at all, right?

    George,

    Assuming that the process that creates the thread is using the DLL, yes, every thread created by that process will call 'DllMain' with flag 'DLL_THREAD_ATTACH' - disregarding whether this thread actually use anything from the DLL.
    Sunday, October 21, 2007 11:06 PM

All replies

  • Correct for DLL_PROCESS_*  but not for DLL_THREAD_ATTACH is not called when your DLL is loaded by that thread, usually all the DLLs loaded in that process are available for all the threads running in that process. So DLL_THREAD_ATTACH is just a notification of new thread creation/activation, same for DLL_THREAD_DETACH.

    Friday, October 19, 2007 7:30 AM
  • Thanks Ramkrishna,

     

    I am confused about what do you mean *just a notification of new thread creation/activation*. Support the host process is creating a new thread, you mean whether or not the thread will utilize the DLL, the DllMain will be invoked with parameter DLL_THREAD_ATTACH or DLL_THREAD_DETACH?

     

    If I do not understand your points correctly, could you provide some simple pseudo code please?

     

     Ramkrishna Pawar wrote:

    Correct for DLL_PROCESS_*  but not for DLL_THREAD_ATTACH is not called when your DLL is loaded by that thread, usually all the DLLs loaded in that process are available for all the threads running in that process. So DLL_THREAD_ATTACH is just a notification of new thread creation/activation, same for DLL_THREAD_DETACH.

     

     

    regards,

    George

    Friday, October 19, 2007 8:14 AM
  •  George2 wrote:

    Thanks Ramkrishna,

     

    I am confused about what do you mean *just a notification of new thread creation/activation*. Support the host process is creating a new thread, you mean whether or not the thread will utilize the DLL, the DllMain will be invoked with parameter DLL_THREAD_ATTACH or DLL_THREAD_DETACH?

     

    If I do not understand your points correctly, could you provide some simple pseudo code please?

     

     Ramkrishna Pawar wrote:

    Correct for DLL_PROCESS_*  but not for DLL_THREAD_ATTACH is not called when your DLL is loaded by that thread, usually all the DLLs loaded in that process are available for all the threads running in that process. So DLL_THREAD_ATTACH is just a notification of new thread creation/activation, same for DLL_THREAD_DETACH.

     

     

    regards,

    George

    Yes, when new thread is created DLLMain is called for reason DLL_THREAD_ATTACH.

     

    Here is quote from MSDN,

     

    DLL_THREAD_ATTACH

    The current process is creating a new thread. When this occurs, the system calls the entry-point function of all DLLs currently attached to the process. The call is made in the context of the new thread. DLLs can use this opportunity to initialize a TLS slot for the thread. A thread calling the DLL entry-point function with DLL_PROCESS_ATTACH does not call the DLL entry-point function with DLL_THREAD_ATTACH.

    Note that a DLL's entry-point function is called with this value only by threads created after the DLL is loaded by the process. When a DLL is loaded using LoadLibrary, existing threads do not call the entry-point function of the newly loaded DLL.

    Friday, October 19, 2007 10:07 AM
  • Thanks Ramkrishna,


    It is interesting and after reading MSDN reference, I think each time a new thread is created, DllMain will be invoked (as callback function) with DLL_THREAD_ATTACH value (support DLL is loaded before creating thread) -- even if the thread does not use the DLL at all, right?


    regards,
    George

     

     Ramkrishna Pawar wrote:

     George2 wrote:

    Thanks Ramkrishna,

     

    I am confused about what do you mean *just a notification of new thread creation/activation*. Support the host process is creating a new thread, you mean whether or not the thread will utilize the DLL, the DllMain will be invoked with parameter DLL_THREAD_ATTACH or DLL_THREAD_DETACH?

     

    If I do not understand your points correctly, could you provide some simple pseudo code please?

     

     Ramkrishna Pawar wrote:

    Correct for DLL_PROCESS_*  but not for DLL_THREAD_ATTACH is not called when your DLL is loaded by that thread, usually all the DLLs loaded in that process are available for all the threads running in that process. So DLL_THREAD_ATTACH is just a notification of new thread creation/activation, same for DLL_THREAD_DETACH.

     

     

    regards,

    George

    Yes, when new thread is created DLLMain is called for reason DLL_THREAD_ATTACH.

     

    Here is quote from MSDN,

     

    DLL_THREAD_ATTACH

    The current process is creating a new thread. When this occurs, the system calls the entry-point function of all DLLs currently attached to the process. The call is made in the context of the new thread. DLLs can use this opportunity to initialize a TLS slot for the thread. A thread calling the DLL entry-point function with DLL_PROCESS_ATTACH does not call the DLL entry-point function with DLL_THREAD_ATTACH.

    Note that a DLL's entry-point function is called with this value only by threads created after the DLL is loaded by the process. When a DLL is loaded using LoadLibrary, existing threads do not call the entry-point function of the newly loaded DLL.

    Sunday, October 21, 2007 7:04 AM
  •  George2 wrote:
    It is interesting and after reading MSDN reference, I think each time a new thread is created, DllMain will be invoked (as callback function) with DLL_THREAD_ATTACH value (support DLL is loaded before creating thread) -- even if the thread does not use the DLL at all, right?

    George,

    Assuming that the process that creates the thread is using the DLL, yes, every thread created by that process will call 'DllMain' with flag 'DLL_THREAD_ATTACH' - disregarding whether this thread actually use anything from the DLL.
    Sunday, October 21, 2007 11:06 PM
  • It is interesting, thanks Andreas!

     

     

     Andreas Masur wrote:

     George2 wrote:
    It is interesting and after reading MSDN reference, I think each time a new thread is created, DllMain will be invoked (as callback function) with DLL_THREAD_ATTACH value (support DLL is loaded before creating thread) -- even if the thread does not use the DLL at all, right?

    George,

    Assuming that the process that creates the thread is using the DLL, yes, every thread created by that process will call 'DllMain' with flag 'DLL_THREAD_ATTACH' - disregarding whether this thread actually use anything from the DLL.

     

     

    regards,

    George

    Monday, October 22, 2007 7:37 AM