ITachiLab / hotkey-detective

A small program for investigating stolen hotkeys under Windows 8+
GNU General Public License v3.0
362 stars 16 forks source link

Injected DLL is not being unloaded from the processes #5

Open ITachiLab opened 3 years ago

ITachiLab commented 3 years ago

When a DLL is loaded into processes as a result of invoking SetWindowHookEx, the DLL remains in the processes after exiting Hotkey Detective. As a consequence, the DLL cannot be deleted from user's disk, because it's still used by the system. It's not possible to simply unload a DLL from a foreign process.

A possible solution is to implement a logic inside the DLL that will make it to unload itself. I'm thinking about using CreateTimerQueue to periodically check for global "unloading event" that will be signaled when Hotkey Detective is being closed.