简介: DisableThreadLibraryCalls

BOOL WINAPI DisableThreadLibraryCalls(
  __in  HMODULE hModule
);

Disables the DLL_THREAD_ATTACH and DLL_THREAD_DETACH notifications for the specified dynamic-link library (DLL). This can reduce the size of the working set for some applications.

 

禁用指定的DLL的DLL_THREAD_ATTACH和DLL_THREAD_DETACH通知,这样可以减小某些程序的工作集大小。

 

Remarks:

 

The DisableThreadLibraryCalls function lets a DLL disable the DLL_THREAD_ATTACH and DLL_THREAD_DETACH notification calls. This can be a useful optimization for multithreaded applications that have many DLLs, frequently create and delete threads, and whose DLLs do not need these thread-level notifications of attachment/detachment. A remote procedure call (RPC) server application is an example of such an application. In these sorts of applications, DLL initialization routines often remain in memory to service DLL_THREAD_ATTACH and DLL_THREAD_DETACH notifications. By disabling the notifications, the DLL initialization code is not paged in because a thread is created or deleted, thus reducing the size of the application's working code set. To implement the optimization, modify a DLL's DLL_PROCESS_ATTACH code to call DisableThreadLibraryCalls.

 

该函数禁用一个DLL的DLL_THREAD_ATTACH和DLL_THREAD_DETACH通知。这对于那些经常创建和删除线程的调用很多DLL的多线程程序是一个很有用的选项。如果这些DLL并不需要这些线程级的attachment/detachment通知。远程过程调用服务程序就是一个例子。在这些程序里,DLL的初始化代码经常留在物理内存里,以相应DLL_THREAD_ATTACH和DLL_THREAD_DETACH通知。通过禁用这些通知,DLL的初始化代码不会由于线程的创建和删除被换页至物理内存,这样就可以减小工作代码集的大小。要实现这个选项,可以在响应DLL_PROCESS_ATTACH通知的时候调用DisableThreadLibraryCalls

入口点注入是一种常用的DLL注入技术,它通过修改PE文件的入口点来实现DLL注入。以下是一个简单的C/C++代码示例,演示如何使用入口点注入技术来注入DLL: ```c++ #include <windows.h> #include <tchar.h> // 定义DLL文件名 #define DLL_NAME _T("YourDLL.dll") // 入口点函数 BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) { if (fdwReason == DLL_PROCESS_ATTACH) { // 在进程初始化时执行注入 DisableThreadLibraryCalls(hinstDLL); InjectDLL(); } return TRUE; } // 注入DLL void InjectDLL() { // 获取当前模块的句柄和入口点地址 HMODULE hModule = GetModuleHandle(NULL); LPVOID lpEntryPoint = GetProcAddress(hModule, "EntryPoint"); // 打开目标进程 HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId); // 获取目标进程的模块句柄和入口点地址 HMODULE hRemoteModule = GetModuleHandleEx(hProcess, NULL, DLL_NAME); LPVOID lpRemoteEntryPoint = GetProcAddress(hRemoteModule, "EntryPoint"); // 获取PE文件头 PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)hRemoteModule; PIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)((DWORD)pDosHeader + pDosHeader->e_lfanew); // 修改入口点地址 DWORD dwOldProtect; VirtualProtect((LPVOID)pNtHeader->OptionalHeader.AddressOfEntryPoint, sizeof(DWORD), PAGE_EXECUTE_READWRITE, &dwOldProtect); *(DWORD*)pNtHeader->OptionalHeader.AddressOfEntryPoint = (DWORD)lpEntryPoint; VirtualProtect((LPVOID)pNtHeader->OptionalHeader.AddressOfEntryPoint, sizeof(DWORD), dwOldProtect, NULL); // 关闭目标进程句柄 CloseHandle(hProcess); } ``` 需要注意的是,此代码仅供参考,实际使用时需要根据具体情况进行修改和适配。另外,在使用DLL注入技术时需要小心谨慎,避免对系统和其他进程造成不良影响。
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值