DLL_PROCESS_ATTACH failing to execute on Windows 7 C++

Question

I am trying to load a .dll file and have it display a message box when loaded. From my understanding, once a .dll is loaded, it makes a call to dllmain() and switches to the DLL_PROCESS_ATTACH option. I have written the code for both the .dll and the .exe which loads it. The .exe can load it correctly and print out the address in which the dll has been loaded, but I do not see a message box being displayed. I read somewhere on Microsoft.com that the dll enters a "lock" when loaded as to prevent certain functions or code from being executed for security purposes. Is this feature blocking a message box from being displayed? Is there a work around such as elevated privileges, system, etc...? I am not sure if DEP has any effect either, I have it set to only protect critical Windows processes.

The calling process:

#include <iostream>
#include <windows.h>
int main()
{
    HMODULE hDll = LoadLibraryA("dll.dll");
    if (hDll == NULL)
        std::cerr << "Unable to load dll";
    else
        std::cout << "Dll loaded @ " << hDll;
    FreeLibrary(hDll);
}

The dll file:

#include <windows.h>
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
    switch (fdwReason)
    {
        case DLL_PROCESS_ATTACH:
            MessageBox(NULL, "Dll has been loaded.", "Loaded", MB_OK);
            break;
    }
    return TRUE;
}

I think it might help me if I had a way to run the .dll though a debugger and see what MessageBox() returned, but I am not sure how to do that. Thanks!

Just guessing here, but you *don't actually do anything* with the DLL apart from "Load" it in name -- you might find that Windows lazily calls `DllMain` the first time you do something substantial with the library. — ta.speot.is, Dec 19 '11 at 04:06

score 5 · Answer 1 · answered Dec 19 '11 at 03:43

Raymond Chen has something to say about this in his blog entry titled Some reasons not to do anything scary in your DllMain:

And absolutely under no circumstances should you be doing anything as crazy as creating a window inside your DLL_PROCESS_ATTACH. In addition to the thread affinity issues, there's the problem of global hooks. Hooks running inside the loader lock are a recipe for disaster. Don't be surprised if your machine deadlocks.

score 1 · Answer 2 · edited May 23 '17 at 12:27

In addition to the blog post Greg links to there are several other informative posts about the loader lock and things you should not do in DllMain.

In general you should only call functions in kernel32 that don't create threads/windows, use COM or calls LoadLibrary (or other functions involving the loader lock).

A reasonable list of safe things IMHO would be: DisableThreadLibraryCalls, Tls*, InitializeCriticalSection and in your case (for debugging purposes); OutputDebugString

DLL_PROCESS_ATTACH failing to execute on Windows 7 C++

2 Answers2

Linked