Is it possible to unload a user DLL from a process created by the DetourCreateProcessWithDllEx function?

[XiaopengZHOU]

Hello everybody,

I want to unload the DLL (inserted with DetourCreateProcessWithDllEx) after use. But the FreeLibrary (or FreeLibraryAndExitThread) function does not work for this case. Is there a solution ?

Thank you so much!

[sylveon]

When using this method, the DLL is injected by starting the process suspended (before the system can resolve any DLL), adding your DLL to the import table of the process, then resuming the process. So, it's considered a hard dependency of the process by the system.

If you want the DLL to be unloadable, you have to use other techniques to inject at runtime instead of at startup like CreateRemoteThread with LoadLibrary, or SetWindowsHookEx. Alternatively, you could do something like making the DLL uninstall all its hooks, making it do effectively nothing in the process anymore.