3

I have tried to inject the DLL into another process by using EasyHook, but when the host process is shut down, the EasyHook and other injected DLLs are still in process. Does anyone know how to unload them from target process?

Thanks.

duongkha
  • 71
  • 6

2 Answers2

2

The current version of Easyhook unloads injected dll when its executing app domain exits. If you want to exit the injected dll from your injection program, make some form of communication possible with the injected dll, to let it know that its time to exit its app domain.

See this issue

Jehonathan Thomas
  • 2,110
  • 1
  • 28
  • 34
0

As the EasyHook 2.6 Tutorial says:

The Run method can be treated as application entry point. If you return from it, your library will be unloaded. But this is not really true ;-). In fact your library stays alive until the CLR decides to unload it. This behavior might change in future EasyHook versions by utilizing the CLR Hosting API, but currently we simply don’t know about!

So all you can do is be sure that you properly return from the Run method so that your injected DLL is no longer actively hooked or operating. It will remain there, dead, until the process is finally terminated. As far as the current EasyHook version (2.7), there is nothing you can do to forcibly unload it.

Lucio Paiva
  • 19,015
  • 11
  • 82
  • 104