Detect when a Module (DLL) is unloaded

后端 未结 4 1455
萌比男神i
萌比男神i 2020-12-16 17:32

Is there a way to progammatically detect when a module - specifically a DLL - has been unloaded from a process?

I don\'t have the DLL source, so I can\'t change it\'

4条回答
  •  时光说笑
    2020-12-16 17:53

    One very bad way(which was used by starcraft 2), is to make your program attach to itsself then monitor for the dll unload debug event(http://msdn.microsoft.com/en-us/library/ms679302(VS.85).aspx), else you'd either need to IAT hook FreeLibrary and FreeLibraryEx in the process or hotpatch the functions in kernel32 them monitor the names being passed and the global reference counts.

提交回复
热议问题