- 1 year ago
DllMain() not called when injecting but called with LoadLibrary()
If DllMain()
is not called when injecting a DLL but is called when using LoadLibrary()
directly, there are a few potential reasons for this behavior. Here are some possible causes and troubleshooting steps:
Exported function name: Ensure that the exported function in your DLL is named
DllMain
and not modified or decorated in any way. The function should have the following signature:cppBOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
Injection method: Verify the injection method you are using. Different injection techniques (e.g., manual injection, DLL injection frameworks, or third-party tools) may have specific requirements or limitations. Ensure that you are following the correct procedure for your chosen injection method.
Calling convention: Check the calling convention of the exported
DllMain
function. By default, the calling convention for Windows DLLs isstdcall
. Ensure that the calling convention matches in both the DLL and the calling code.Injection target process architecture: Confirm that the injection target process matches the architecture (32-bit or 64-bit) of the DLL. A 32-bit DLL cannot be injected into a 64-bit process, and vice versa.
DLL dependencies: Make sure that all dependencies required by your DLL are present and accessible to the target process. Missing or inaccessible dependencies may prevent the DLL from being loaded and
DllMain()
from being called.Exception handling: Ensure that there are no unhandled exceptions or crashes occurring within the injected DLL. An unhandled exception or crash can cause the process to terminate without invoking
DllMain()
.
By investigating these possibilities and ensuring proper configuration, you should be able to determine why DllMain()
is not being called during DLL injection. Additionally, consider using logging or debugging techniques to gain more insights into the injection process and any potential errors or exceptions occurring during the injection.