Ending all DLL instances

I have a DLL which has a Hook function. My app loads the initial instance of
the DLL and calls an initialize function to start the hook etc. This hook is
a system wide hook and can attach to all sorts of window (not belonging to
my app). If I end my app, first calling another function to end the hooks,
the other DLL instances are still there. Is there a way to end all instances
of the DLL in one go?

Alex
Sun Aug 21 05:59:03 CDT 2005

Lindsay wrote:
> I have a DLL which has a Hook function. My app loads the
> initial instance of the DLL and calls an initialize
> function to start the hook etc. This hook is a system
> wide hook and can attach to all sorts of window (not
> belonging to my app). If I end my app, first calling
> another function to end the hooks, the other DLL
> instances are still there. Is there a way to end all
> instances of the DLL in one go?

No, you can't unload DLL from other processes. Here's
quotation from MSDN:

---
You can release a global hook procedure by using
UnhookWindowsHookEx, but this function does not free the DLL
containing the hook procedure. This is because global hook
procedures are called in the process context of every
application in the desktop, causing an implicit call to the
LoadLibrary function for all of those processes. Because a
call to the FreeLibrary function cannot be made for another
process, there is then no way to free the DLL. The system
eventually frees the DLL after all processes explicitly
linked to the DLL have either terminated or called
FreeLibrary and all processes that called the hook procedure
have resumed processing outside the DLL.
---

Lindsay
Sun Aug 21 06:20:15 CDT 2005

What if I stored the instances handles in an array in a shared data segment.
Could I use these handles to kill each instance? According to MSDN, the
instance handles are the same as the module handles, so I should be able to
use FreeLibrary using the handles in the shared array. Would this work?

"Alex Blekhman" <tkfx.N05P4M@yahoo.com> wrote in message
news:OOARZ9jpFHA.3516@TK2MSFTNGP15.phx.gbl...
> Lindsay wrote:
>> I have a DLL which has a Hook function. My app loads the
>> initial instance of the DLL and calls an initialize
>> function to start the hook etc. This hook is a system
>> wide hook and can attach to all sorts of window (not
>> belonging to my app). If I end my app, first calling
>> another function to end the hooks, the other DLL
>> instances are still there. Is there a way to end all
>> instances of the DLL in one go?
>
> No, you can't unload DLL from other processes. Here's
> quotation from MSDN:
>
> ---
> You can release a global hook procedure by using
> UnhookWindowsHookEx, but this function does not free the DLL
> containing the hook procedure. This is because global hook
> procedures are called in the process context of every
> application in the desktop, causing an implicit call to the
> LoadLibrary function for all of those processes. Because a
> call to the FreeLibrary function cannot be made for another
> process, there is then no way to free the DLL. The system
> eventually frees the DLL after all processes explicitly
> linked to the DLL have either terminated or called
> FreeLibrary and all processes that called the hook procedure
> have resumed processing outside the DLL.
> ---
>
>

Alex
Sun Aug 21 07:37:45 CDT 2005

Lindsay wrote:
> What if I stored the instances handles in an array in a
> shared data segment. Could I use these handles to kill
> each instance? According to MSDN, the instance handles
> are the same as the module handles, so I should be able
> to use FreeLibrary using the handles in the shared array.
> Would this work?

I wouldn't rely on that. Instance handle is the memory
address where a module mapping begins in process address
space. It's possible that hook DLL will be mapped at
different addresses in different processes. hence instance
handle will be different.

Suppose you managed to store hook DLL instance handle in
each process. Then you'll need to call FreeLibrary in
context of that process. It's nontrivial task in itself.

Bsically, you need to design your hook with consideration
that unhooking is not instant thing and hook DLL won't be
unloaded immediately, if at all..

Doug
Sun Aug 21 13:09:38 CDT 2005

On Sun, 21 Aug 2005 08:54:07 +0100, "Lindsay" <me@home.com> wrote:

>I have a DLL which has a Hook function. My app loads the initial instance of
>the DLL and calls an initialize function to start the hook etc. This hook is
>a system wide hook and can attach to all sorts of window (not belonging to
>my app). If I end my app, first calling another function to end the hooks,
>the other DLL instances are still there. Is there a way to end all instances
>of the DLL in one go?

I had the same problem, and I eventually came up with the method below,
which I use in Wheeler after uninstalling a global mouse hook:

http://www.eluent.com/wheeler.htm

// The following helps hooked applications unmap the hook DLL.
DWORD_PTR res;
SendMessageTimeout(HWND_BROADCAST, WM_NULL,
0, 0, SMTO_NORMAL, 1000, &res);

--
Doug Harrison
VC++ MVP

Mike
Sun Aug 21 17:43:47 CDT 2005


"Lindsay" <me@home.com> wrote in message
news:43083339$0$97107$ed2619ec@ptn-nntp-reader03.plus.net...
>I have a DLL which has a Hook function. My app loads the initial instance
>of the DLL and calls an initialize function to start the hook etc. This
>hook is a system wide hook and can attach to all sorts of window (not
>belonging to my app). If I end my app, first calling another function to
>end the hooks, the other DLL instances are still there. Is there a way to
>end all instances of the DLL in one go?

I seem to recall running a separate thread that waits on an unload event.
Then call FreeLibraryAndExitThread. The event requires that all waiting
threads are signaled.

M

Lindsay
Mon Aug 22 09:40:44 CDT 2005

Thanks Doug. I'll give it a whirl.

"Doug Harrison [MVP]" <dsh@mvps.org> wrote in message
news:4dghg1dq6t2bspvl89tbn8ei013pkskung@4ax.com...
> On Sun, 21 Aug 2005 08:54:07 +0100, "Lindsay" <me@home.com> wrote:
>
>>I have a DLL which has a Hook function. My app loads the initial instance
>>of
>>the DLL and calls an initialize function to start the hook etc. This hook
>>is
>>a system wide hook and can attach to all sorts of window (not belonging to
>>my app). If I end my app, first calling another function to end the hooks,
>>the other DLL instances are still there. Is there a way to end all
>>instances
>>of the DLL in one go?
>
> I had the same problem, and I eventually came up with the method below,
> which I use in Wheeler after uninstalling a global mouse hook:
>
> http://www.eluent.com/wheeler.htm
>
> // The following helps hooked applications unmap the hook DLL.
> DWORD_PTR res;
> SendMessageTimeout(HWND_BROADCAST, WM_NULL,
> 0, 0, SMTO_NORMAL, 1000, &res);
>
> --
> Doug Harrison
> VC++ MVP