🚀 go-pugleaf

"MWP" <mwp@overclockers.com.au> wrote in message
news:3edf0eb4$1@newsgroups.borland.com...

> Why is DLLEntryPoint being called more often than just when LoadLibrary is
run?

DllEntryPoint() is called whenever the DLL is injected into a process as
well as whenever it is injected into a particular thread, as well as
releasing both.  The 'reason' parameter tells you why the entry point is
being called:

    "Specifies a flag indicating why the DLL entry-point function is being
called. This parameter can be one of the following values:

    DLL_PROCESS_ATTACH
    Indicates that the DLL is attaching to the address space of the current
process as a result of the process starting up or as a result of a call to
LoadLibrary. DLLs can use this opportunity to initialize any instance data
or to use the TlsAlloc function to allocate a thread local storage (TLS)
index.
During initial process startup or after a call to LoadLibrary, the operating
system scans the list of loaded DLLs for the process. For each DLL that has
not already been called with the DLL_PROCESS_ATTACH value, the system calls
the DLL's entry-point function. This call is made in the context of the
thread that caused the process address space to change, such as the primary
thread of the process or the thread that called LoadLibrary.

    DLL_THREAD_ATTACH
    Indicates that the current process is creating a new thread. When this
occurs, the system calls the entry-point function of all DLLs currently
attached to the process. The call is made in the context of the new thread.
DLLs can use this opportunity to initialize a TLS slot for the thread. A
thread calling the DLL entry-point function with the DLL_PROCESS_ATTACH
value does not call the DLL entry-point function with the DLL_THREAD_ATTACH
value.
Note that a DLL's entry-point function is called with this value only by
threads created after the DLL is attached to the process. When a DLL is
attached by LoadLibrary, existing threads do not call the entry-point
function of the newly loaded DLL.

    DLL_THREAD_DETACH
    Indicates that a thread is exiting cleanly. If the DLL has stored a
pointer to allocated memory in a TLS slot, it uses this opportunity to free
the memory. The operating system calls the entry-point function of all
currently loaded DLLs with this value. The call is made in the context of
the exiting thread. There are cases in which the entry-point function is
called for a terminating thread even if the DLL never attached to the thread
� for example, the entry-point function was never called with the
DLL_THREAD_ATTACH value in the context of the thread in either of these two
situations:� The thread was the initial thread in the process, so the system
called the entry-point function with the DLL_PROCESS_ATTACH value. � The
thread was already running when a call to the LoadLibrary function was made,
so the system never called the entry-point function for it.

    DLL_PROCESS_DETACH
    Indicates that the DLL is detaching from the address space of the
calling process as a result of either a clean process exit or of a call to
FreeLibrary. The DLL can use this opportunity to call the TlsFree function
to free any TLS indices allocated by using TlsAlloc and to free any thread
local data. When a DLL detaches from a process as a result of process
termination or as a result of a call to FreeLibrary, the operating system
does not call the DLL's entry-point function with the DLL_THREAD_DETACH
value for the individual threads of the process. The DLL is only given
DLL_PROCESS_DETACH notification. DLLs can take this opportunity to clean up
all resources for all threads attached and known to the DLL.


Gambit