[Windows programming] monitor DLL loading/unloading

The ldrregisterdllnotification and ldrunregisterdllnotification functions are provided in the Windows driver development library, allowing you to monitor the process load/uninstall DLL events. You want to hook the function of a DLL when it is loaded; or you want to do some saving and cleaning work before a DLL is launched; or when you want to prevent a DLL from being loaded (such as a plug-in ).... this mechanism is useful.

 

 

Below isSample CodeHow to Use ldrregisterdllnotification and ldrunregisterdllnotification to listen for DLL loading/unloading.

 

 # Include <ntsecapi. h> // DDK <br/> typedef const unicode_string * pcunicode_string; </P> <p> typedef struct _ ldr_dll_loaded_icationication_data {<br/> ulong flags; // reserved. <br/> pcunicode_string fulldllname; // the full path name of the DLL module. <br/> pcunicode_string basedllname; // The Base File Name of the DLL module. <br/> pvoid dllbase; // a pointer to the base address for the DLL in memory. <br/> ulong sizeofimage; // the size of the DLL image, in bytes. <br/>} ldr_dll_loaded_notification_data, * response; </P> <p> typedef struct _ ldr_dll_unloaded_notification_data {<br/> ulong flags; // reserved. <br/> pcunicode_string fulldllname; // the full path name of the DLL module. <br/> pcunicode_string basedllname; // The Base File Name of the DLL module. <br/> pvoid dllbase; // a pointer to the base address for the DLL in memory. <br/> ulong sizeofimage; // the size of the DLL image, in bytes. <br/>} ldr_dll_unloaded_notification_data, * response; </P> <p> typedef union _ ldr_dll_icationication_data {<br/> ldr_dll_loaded_icationication_data loaded; <br/> upload unloaded; <br/>} ldr_dll_notification_data, * success; </P> <p> typedef const pldr_dll_notification_data pcldr_dll_notification_data; </P> <p> typedef void (ntapi * pldr_dll_notification_function) (ulong notificationreason, pcldr_dll_icationication_data notificationdata, pvoid context); <br/> typedef ntstatus (ntapi * handle) (ulong flags, pldr_dll_notification_function notificationfunction, void * context, void ** cookie ); <br/> typedef ntstatus (ntapi * pfnldrunregisterdllnotification) (void * cookie ); </P> <p> # define ldr_dll_notification_reason_loaded 1 <br/> # define limit 2 </P> <p> void ntapi myldrdllnotification (<br/> ulong notificationreason, <br/> pcldr_dll_notification_data notificationdata, <br/> pvoid context <br/>) <br/>{< br/> switch (icationicationreason) <br/>{< br/> case ldr_dll_notification_reason_loaded: <br/> printf ("DLL loaded: % s/n", notificationdata-> loaded. fulldllname-> buffer); <br/> break; <br/> case ldr_dll_notification_reason_unloaded: <br/> printf ("DLL unloaded: % s/n", icationicationdata-> unloaded. fulldllname-> buffer); <br/> break; <br/>}</P> <p> int _ tmain (INT argc, _ tchar * argv []) <br/>{</P> <p> hmodule = getmodulehandlew (L "NTDLL. DLL "); </P> <p> // obtain the function pointer <br/> using pldrregisterdllnotification = (pfnldrregisterdllnotification) getprocaddress (hmodule," ldrregisterdllnotification "); <br/> pfnldrunregisterdllnotification pldrunregisterdllnotification = (pfnldrunregisterdllnotification) getprocaddress (hmodule, "ldrunregisterdllnotification"); <br/> void * pvcookie = NULL; </P> <p> // initialization <br/> pldrregisterdllnotification (0, myldrdllnotification, null, & pvcookie ); </P> <p> // test DLL loading <br/> hmodule hload =: loadlibraryw (L "mshtml. DLL "); <br/> sleep (1000); <br/> // test DLL uninstall <br/>: freelibrary (hload ); </P> <p> // clear <br/> If (pvcookie) <br/>{< br/> pldrunregisterdllnotification (pvcookie); <br/> pvcookie = NULL; <br/>}</P> <p> return 0; <br/>}< br/>

 

Run the program,Output:. It can be confirmed that the above Code monitors the loading and unloading of mshtml. dll. Other DLL files automatically loaded by the system are also monitored.

 

DLL loaded: C:/Windows/system32/mshtml. dll
DLL loaded: C:/Windows/system32/msls31.dll
DLL loaded: C:/Windows/system32/version. dll
DLL unloaded: C:/Windows/system32/mshtml. dll
DLL unloaded: C:/Windows/system32/version. dll
DLL unloaded: C:/Windows/system32/msls31.dll

 

 

> Original article copyright belongs to the author, reprint please indicate the source and author information (http://blog.csdn.net/WinGeek/), thank you. <