How to get notification of DLL loads happening in

问题:

First of all, some background:

My software which is written in VC++ relies on some large third party DLL's that get loaded along with my app. These libs often raise Floating point exceptions during their normal course of operation, but they are not signaled as hardware exceptions because of the default configuration of Floating point Control word to mask these exceptions and hence the program does not crash because of these.

Now the issue is that when some third party programs like Zeallsoft Super Screen Capture inject their own DLLs which are written in Borland C++, they set the FP Control Word to enable the Floating point exceptions and my app crashes because of that.

While the main issue might be with the third party lib and the third party software that is injecting its own Dll's, I still want to protect my software from crashing because of such an issue.

The solution that I can think of is to some how get notification of Dll loads happening inside my process and ensure that the FP control word is reset to default value after the dll load happens.

So I am looking for simple and effective ways to achieve that. Is there some way to get notified of Dll loads happening in my process? Are there any other way of achieving what I want to do? The only thing that I want to be wary of is that the method should work on Win 2k and WinXP and higher and secondly the method used should not be of a nature that can potentially trigger the malware heuristics of Anti-virus/spyware scanners.

回答1:

You can do this with the windows Debugger API, specifically you want to monitor the LOAD_DLL_DEBUG_EVENT debug event. it should be noted that debugging yourself is dangerous as it can lead to app locking, it also means you can't debug it normally.

the alternative is do a process-wide Hot Patch (a better paper on it) hook on LoadLibraryEx, LoadLibraryA and LoadLibraryW and check the dll's passing through there.

the main problem with this is you need to make sure you install the hooks/monitors before anything else (that you care about) in the process loads, which may require more 'black magic'....

回答2:

It is the responsibility of the DLL to restore the FPU state.

You can detect the FPU state problem at the time of unhanded exception and reset the FPU state, but the dll may not behave correctly after that (some people do rely on FPU exceptions, and there is a reason why they enable it). You can notify the user that an incompatible dll is injected to your process which will cause unpredictable behavior.

You can also scan the program files folder (or the Windows Installer database) and warn the user a known compatibility problem exists.