29

What is the difference between the three functions and when to use them??

sorin
  • 161,544
  • 178
  • 535
  • 806
Ahmed
  • 7,148
  • 12
  • 57
  • 96
  • https://reverseengineering.stackexchange.com/questions/2079/difference-between-dllmain-and-dllentrypoint – Gabriel Jul 05 '18 at 08:10

3 Answers3

26

main() means your program is a console application.

WinMain() means the program is a GUI application -- that is, it displays windows and dialog boxes instead of showing console.

DllMain() means the program is a DLL. A DLL cannot be run directly but is used by the above two kinds of applications.

Therefore:

  • Use WinMain when you are writing a program that is going to display windows etc.
  • Use DLLMain when you write a DLL.
  • Use main in all other cases.
G S
  • 35,511
  • 22
  • 84
  • 118
  • A DLL can run directly if you're using rundll32.exe – shoosh Jan 06 '09 at 16:34
  • 19
    @Shy: Using rundll32.exe to run a DLL is to run the DLL indirectly. ;) – dalle Jan 06 '09 at 17:49
  • 9
    WinMain simply means that there will be NO console window allocated for the app, and its stdin and stdout have nowhere to go. All the guts of Windows API (such as event loop, registration of classes, window creation) still need to be done manually. Also, programs using main() can have windows too. –  Jan 06 '09 at 18:28
  • 2
    Here is a post from a Windows developer on this same topic http://blogs.msdn.com/oldnewthing/archive/2009/01/01/9259142.aspx –  Jan 09 '09 at 16:43
  • 9
    -1 "main() means your program is a console application." is incorrect. my GUI subsystem programs always use a standard `main`. there is no technical reason to use the non-standard startup functions. – Cheers and hth. - Alf Dec 14 '12 at 04:07
12

WinMain is used for an application (ending .exe) to indicate the process is starting. It will provide command line arguments for the process and serves as the user code entry point for a process. WinMain (or a different version of main) is also a required function. The OS needs a function to call in order to start a process running.

DllMain is used for a DLL to signify a lot of different scenarios. Most notably, it will be called when

  1. The DLL is loaded into the process: DLL_PROCESS_ATTACH
  2. The DLL is unloaded from the process: DLL_PROCESS_DETACH
  3. A thread is started in the process: DLL_THREAD_ATTACH
  4. A thread is ended in the process: DLL_THREAD_DETACH

DllMain is an optional construct and has a lot of implicit contracts associated with it. For instance, you should not be calling code that will force another DLL to load. In general it's fairly difficult function to get right and should be avoided unless you have a very specific need for it.

JaredPar
  • 733,204
  • 149
  • 1,241
  • 1,454
  • 1
    This is a good explanation ut it needs to also specify that these are required entry points for the three different types of "executables" (console app, windows app, windows DLL). – Jon Trauntvein Jan 06 '09 at 14:42
  • 3
    -1 "WinMain (or a different version of main) is also a required function" is wrong. It's not a windows thing, it's a Microsoft language extension thing. And it's not even required with Microsoft's tools. And, it's not called by the OS. It's called by the process' entry point function. – Cheers and hth. - Alf Dec 14 '12 at 03:48
0

[Addendum to your question]

Also don't forget the DllEntryPoint:

  • When loading time is involved the entry point is DllMain.
    (Ex. COM in-process server DLL).

  • When running time is involved the entry point is DllEntryPoint.
    (Ex. LoadLibrary get called).

Gabriel
  • 20,797
  • 27
  • 159
  • 293