winapi - How to protect yourself against shell DLLs loaded into your process?

Question

When you use a standard Windows "file open" dialog using GetOpenFileName(), the shell will load various DLLs that it requires to display the file list, including custom ones.

In my application, I found that the DLL that TortoiseCVS uses to draw overlays on the icons was calling GdiPlusShutdown(), and so some time after displaying a "file open" dialog, the TortoiseCVS DLL would be unloaded, it would shut down GDI+ and my graphics functions would all fail!

It seems quite bad that basically any old DLL could be loaded by my application at any time and start doing random things to its state. The workaround in my case was quite simple - just restart GDI+ if I detect that it's been shut down. However had this happened on a client's machine where I couldn't debug it, it would have been a lot more challenging to figure out what was going on.

Can anybody offer any insight? What could I do to stop this from happening?

Answer 1

我不得不处理戴尔在其机器上放置的垃圾，尤其是 wxVault。我的解决方案是“简单地”修补代码。DEP 有点棘手，但仍然可行。你可以看一下 Microsoft Detours，这是一种更结构化的方式来做同样的事情。您仍然需要加载 DLL，但至少您可以阻止它调用不应调用的函数。

要了解 Windows 为何具有如此糟糕的机制，请阅读 Raymond Chen 的“Old New Thing”博客或书籍。