When will DllMain be called with the DLL_PROCESS_VERIFIER flag?

Question

On Windows, the standard DLL entry point is called DllMain. The second parameter is a DWORD, ul_reason_for_call.

I have looked up the possible values for this second parameter on MSDN. The following are obvious:

DLL_PROCESS_ATTACH:
DLL_THREAD_ATTACH:
DLL_THREAD_DETACH:
DLL_PROCESS_DETACH:

But what about:

DLL_PROCESS_VERIFIER

When will the entry point be called with this flag? Should I worry about it during 'normal' operation of the DLL?

Note that I only see DLL_PROCESS_VERIFIER in header files from Visual Studio 2005, not 2008.

score 5 · Accepted Answer · answered Mar 15 '10 at 17:04

5

I guess in theory Microsoft could invent new usages and flags any time they feel they need a new one. So the simple rule is to ensure that your code tolerates unexpected values: i.e. write it to handle the cases that you need to handle and ignore the rest, by returning zero.

answered Mar 15 '10 at 17:04

Chris Becke

34,244
12
79
148

Agreed. Currently my code is { case DLL_PROCESS_VERIFIER: default: return 0; } However my question relates to when / why this would currently happen. – Konrad Mar 15 '10 at 17:09
The general consensus seems to be its probably sent as a result of dlls being invoked in a process being measured by Application Verifier. Which is shipped as part of visual studio Im sure, so it should be "easy" to put some kind of logging code, and test to see if it is. during normal operation? obviously never. – Chris Becke Mar 15 '10 at 19:36
1

I advise *against* mentioning it explicitly in your switch statement, @Whyam. It gives the false impression that you've given thought to how your program should handle that value, when you obviously couldn't have since you don't know what it's for. By including it in your code, you're inviting future maintainers of the code to ask you what it's for, which will waste your time and theirs. It's best to just pretend it doesn't exist at all. – Rob Kennedy Mar 15 '10 at 21:53

score 1 · Answer 2 · answered Mar 15 '10 at 17:22

1

This is really obscure. It is not ever documented in the SDK and doesn't appear in the SDK header files. Google produces only a few hits, most sites are down or untrusted. The only decent hit I get is XBox code, it only declares it but doesn't actually use it.

I'm not sufficiently convinced that this is a real code that you'd ever encounter in a regular Windows program.

answered Mar 15 '10 at 17:22

Hans Passant

922,412
146
1,693
2,536

+1 for the msdn link. I didn't actually see that one because I was simply googling for 'DLL_PROCESS_VERIFIER'. The only reason I found it was because I was poking around in the header files. – Konrad Mar 15 '10 at 17:29
It doesn't get passed to ordinary DLLs, only those specially listed in a `VerifierDlls` registry entry. See https://skanthak.homepage.t-online.de/verifier.html – Ben Voigt Feb 15 '19 at 06:31

score 0 · Answer 3 · answered Mar 15 '10 at 17:11

0

I think it can have then value if it is run through Application Verifier. Kind of guessing :)

answered Mar 15 '10 at 17:11

Adam Driscoll

9,395
9
61
104

When will DllMain be called with the DLL_PROCESS_VERIFIER flag?

3 Answers3