DLL ADVANCED TECHNIQUES

1
DLL ADVANCED TECHNIQUES
????????
?????
2
Explicit DLL Module Loadingand Symbol Linking

• ???? DLL ?function,????? DLL map ?? process ?
  address space
• ?? 1 (implicitly load)
• ? thread ??? function ??, Loader
  ??????????DLL,????
• ?? 2 (explicit load)
• ??????
• Thread ????????? DLL ?????,????????? virtual
  address, ????

load-time dynamic linking
run-time dynamic linking
3
DLL export ???
?? DLL ???
export ????,?? Symbol ? header file
Import ??????? ??
????? DLL ?? function
?????
?? obj ?
?? obj
??? DLL ??? ?? lib ?
???? obj ?? ? exe ???
10. Loader ? exe ? ??? address
space,????
11. Thread ?? LoadLibrary() ? DLL ??????
GetProcAddress()???? ???
4
Explicitly Loading the DLL Module

• Process ????,????

HINSTANCE LoadLibrary (PCTSTR pszDLLPathName)
DLL ????
HINSTANCE LoadLibraryEx(
PCTSTR pszDLLPathName,
HANDLE hFile,
DWORD dwFlags)
??, ??? NULL
DONT_RESOLVE_DLL_REFERENCE ?????? DllMain ???

??????? DLL ? reference
??? DLL
LOAD_LIBRARY_AS_DATAFILE ???? DLL ? data
5
Explicitly Unloading the DLL Module

• ?? FreeLibrary(HINSTANCE hinstDll)
• ???????
• VOID FreeLibraryAndExitThread( HINSTANCE
  hinstDll,
• 
  DWORD dwExitCode)

? LoadLibrary ??? ? handle
????? FreeLibrary( hinstDll)
ExitThread (dwExitCode)
6
??????

• ?????? DLL ?????? thread ??????, ????,?? free DLL
  ???? thread.

??? free ?? ?? ExitThread?code ? free ??. (???)
Main thread
Access Violation
new thread
LoadLibray
???
FreeLibrary()
???
ExitThread()
???
DLL
7
????FreeLibraryAndExitThread

• ?? ExitThread ?? Kernel32 ?,??????

ExitThread ???? kernel32.dll
? DLL free ?
Main thread
Kernel32.dll
LoadLibray
???
FreeLibrary()
FreeLibraryAndExitThread()
???
ExitThread()
???
????? thread
DLL
8
FreeLibrary ?????

• ?? process ????? DLL ?????

0
1
2
LoadLibray
CreateThread
??? FreeLibary ??
Thread 1
9
FreeLibrary ?????
Process B
Process A
LoadLibrary(MyDLL.dll)
LoadLibrary(MyDLL.dll)
Process A ???? ????
MyDLL.dll
1
1
????
map
map
10
FreeLibrary ?????
Process A
Process B
Process A
LoadLibrary(MyDLL.dll)
LoadLibrary(MyDLL.dll)
MyDLL.dll
1
????
0
????
map
?? FreeLibrary
Unmap DLL
11
?? MyDLL ???????

• ?? GetModuleHandle

?? MyLib.dll ???????? Thread ??? process ?????
HINSTANCE hinstDll GetModuleHandle("MyLib")
if (hinstDll NULL) hinstDll
LoadLibrary("..\\MyDLL\\Debug\\MyDll.dll")
?? MyLib.dll ???
??????,????? MyLib.dll
12
???? DLL ?????
include "stdafx.h" include ltwindows.hgt
// for win32AIP include ltiostreamgt //
for cout using namespace std void
ShowError() int _tmain(int argc, _TCHAR
argv) HINSTANCE hinstDll GetModuleHandle("My
DLL") if (hinstDll NULL) hinstDll
LoadLibrary("MyDLL") if(hinstDllNULL) Show
Error() LPTSTR Buffernew TCHAR100
DWORD sizeGetModuleFileName(hinstDll,Buffer
,100) cout ltlt Buffer ltlt endl getchar() retu
rn 0
???? MyDLL.dll ?????????
???? MyDLL.dll ?????
??????,?size 0
13
typedef declarations

• typedef ???? synonym(??)???? type, ?????????

typedef unsigned char BYTE // 8-bit unsigned
entity. typedef BYTE PBYTE // Pointer
to BYTE. BYTE Ch //
Declare a variable of type BYTE. PBYTE pbCh
// Declare a pointer to a BYTE
// variable.
?? type ? unsigned char
?? type ? unsigned char
14
Declare a type name representing a pointer to a
function
?? PVFN ???type name, ????? ?????????????
typedef void (PVFN)()
void func1() void func2() typedef void
(PVFN)() int main() // Declare an array of
pointers to functions. PVFN pvfn func1,
func2 // Invoke one of the functions.
(pvfn1)()
Functions prototype
?? typedef, ?? function pointer ????????
15
Explicitly Linking to an Exported Symbol
???? DLL ?? __stdcall call typedef void
(__stdcall PVFN)()
include ltwindows.hgt typedef int
(MYPROC)(int,int) int _tmain(int argc,
_TCHAR argv) HINSTANCE hinstDll
GetModuleHandle("MyDLL") if (hinstDll NULL)
hinstDll LoadLibrary("MyDLL") if(hinstDll
NULL) ShowError() MYPROC ProcAdd
ProcAdd(MYPROC)GetProcAddress(hins
tDll,"Add") if(ProcAddNULL) ShowError()
int data(ProcAdd)(2,4) // Step
4 Free the DLL module FreeLibrary(hinstDll) r
eturn 0
?? MYPROC ??? type name, ???????function ?pointer
Step 1 ? DLL ??
? DLL ? export ?? ???? (? DLL ?? stdcall ??? .
DEF) ??? _Add_at_8 ??
Step 2 ?? ProcAdd ??? ??? function Add ???
Step 3 ?? Add ??
16
The DLL's Entry-Point Function

• ??? DLL ???? Entry-point function
• DllMain
• ??????????,?? DllMain

??????? DllMain
17
??????
????? explicitly link ? 0 Implicitly link? ? 0 ?
DLL ??? virtual address
BOOL WINAPI DllMain(HINSTANCE hinstDll, DWORD
fdwReason, PVOID fImpLoad) switch
(fdwReason) case DLL_PROCESS_ATTACH
break case DLL_THREAD_ATTACH
// A thread is being created. break
case DLL_THREAD_DETACH // A
thread is exiting cleanly. break
case DLL_PROCESS_DETACH
break return(TRUE) // Used only for
DLL_PROCESS_ATTACH
? DLL ? mapped ? Process? virtual address space
? DLL ? process ? virtual address space unmapped
???
18
????

• DllMain ? ?? initial ??, ?????????????.
• ?? 1 ?????????????? DLL ????????? DllMain.
• ?? 2 ?????? LoadLibrary ? FreeLibrary,
  ?????????? loop
• ?? 3 ???? User?Shell?ODBC?COM?RPC?socket ????
  function, ????????????

?????? DllMain ????? DLL export ? function
19
The DLL_PROCESS_ATTACH Notification

• ? DLL ???? map ? processs address space ??????
• ?????process????? thread ??? LoadLibrary, ? DLL
  ???????
• ????
• ??? DLL ????? Heap ??????

????? DllMain
? DLL ??? global ?? ?? Heap ? Handle ? ?
DLL_PROCESS_ATTACH ?? Heap
20
??? DLL ?????

• ? DLL_PROCESS_ATTACH ???
• FALSE

Implicitly ?????
BOOL WINAPI DllMain() switch (fdwReason)
case DLL_PROCESS_ATTACH return(FALSE)
break
?????, ????? DllMain ?????
21
???? DllMain ???
Implicity linking ???
???? Process
?? entry function main/ wmain WinMain/ wWinMain
???? virtual space
??? DllMain ??? TRUE,??? C/C ? ????
? .exe ? ????? Dll image ??? ? virtual space
???? main thread ???? ?? Dll ? DllMain
? DLL_PROCESS_ATTACH ?? DllMain
? DLL ?????
22
Explicitly linking ???
LoadLibrary ????
void main() HINSTANCE hinstDll hinstDll
LoadLibrary("MyDLL")
???? Dll ????
???? Dll image file ??? Process ? vurtual space ?
?? Dll ? DllMain ()
LoadLibrary ??
? DllMain() ? FALSE ? return NULL
? DLL_PROCESS_ATTACH ?? DllMain
23
DLL_PROCESS_DETACH

• ? Dll ??????,????
• ????
• ??? ATTACH ??? heap, ??? DETACH HeapDestroy ??
  heap
• ?????, ???????
• ????? TerminateProcess
• ????? DLL ? ATTATCH ???,?? FALSE,
• ?? DLL ????? DETACH ??.

?? terminate process ?? ExitProcess
???? unmap ?
void main() HINSTANCE hinstDll hinstDll
LoadLibrary("MyDLL") TerminateProcess(GetCurren
tProcess(),1)
24
?? LoadLibrary ???
25
(No Transcript)
26
FreeLibrary ???
27
DLL_THREAD_ATTACH

• ??? Process ????? thread
• ??? process ??? DLL ?????

DLL_THREAD_DETACH

• ? thread function ???, ??? ExitThread ? ???? DLL
  ??? thread ????

TerminateThread ????????
28
Serialized calls to DllMain

• ??????????? thread ?,???? DllMain,????DLL_THREAD_A
  TTACH ??

??, ??????? thread ??? DllMain ???? ? No
main thread
CreateThread
CreateThread
B
A
CreateThread
CreateThread
1
2
c
d
DllMain()
d ???? c ?? DllMain ???
29
Bug !!
??? DllMain? ?? WaitForSingleObject
BOOL WINAPI DllMain( ) HANDLE hThread
DWORD dwThreadId switch (fdwReason)
case DLL_PROCESS_ATTACH hThread
CreateThread(NULL, 0, SomeFunction, NULL,
0, dwThreadId)
WaitForSingleObject(hThread, INFINITE) //
We no longer need access to the new thread.
CloseHandle(hThread) break
Step 1 ?? thread
Step 2 Suspend ??? thread,??
??thread ????
????? ?? ?? thread ???? DllMain
30
DllMain ? C/C runtime library
?????? ?? DllMain ????? global ??? static ??.
???? ??? constructor ? destructor ???????
31
_DllMainCRTStartup function

• ??, ?? link DLL ?, linker ????????????C???functi
  on

_DllMainCRTStartup()
???? Dll ????
void main() HINSTANCE hinstDll hinstDll
LoadLibrary("MyDLL")
32
void main() HINSTANCE hinstDll hinstDll
LoadLibrary("MyDLL")
????? ?????? _DllMainCRTStartup ???? DllMain
???? Dll ????
?? _DllMainCRTStartup
???? Dll image file ??? Process ? virtual space ?
Initial C/C run time library
?? Dll ? DllMain ()
???DLL?????? ??C ???????
? DLL_PROCESS_ATTACH ?? DllMain
33
?ExitProcess?
Step 1
?? DLL ? DllMain ()
DLL_PROCESS_DETACH ??
?? _DllMainCRTStartup
?ExitThread?
???DLL?????? ??C ???????
Step 2
?? C/C ? multithread ?????? heap memory tiddata

Step 1
?? DLL ? DllMain ()
DLL_THREAD_DETACH ??
???? _endthread(),? ?? heap ????? free
34
??????? DllMain

• Linker ??????? DllMain

BOOL WINAPI DllMain(HINSTANCE hinstDll, DWORD
fdwReason, PVOID fImpLoad) if (fdwReason
DLL_PROCESS_ATTACH) DisableThreadLibraryCall
s(hinstDll) return(TRUE)
? thread ???????, ????? DllMain
??? DLL_THREAD_ATTACH ? DLL_THREAD_DETACH ?
notification ?? disable ! ??,?????????. ???????
multithread ??? DLL ? server ??, ???
35

• End