Page 1 of 1

Does FinalizeMadCHook Unhook all hooks?

Posted: Tue Mar 25, 2014 12:07 am
by blackpaw
As per the subject - if I am calling FinalizeMadCHook() when my hook DLL unloads, do I also need to call UnhookCode/UnhookAPI?

Experimentation seems to indicate not, but it would be good to know for sure :)

Re: Does FinalizeMadCHook Unhook all hooks?

Posted: Tue Mar 25, 2014 8:18 am
by madshi
Unhooking will be done as part of the UninjectLibrary() processing, and that happens even *before* your dll gets to DllMain(DLL_PROCESS_DETACH). This is very important because unhooking the APIs inside of DllMain() would cause stability issues. Because of that madCodeHook performs the API unhooking automatically before actually calling FreeLibrary(yourHook.dll).

However, if for some reason you unload your hook dll some other way instead of using UninjectLibrary() then yes, FinalizeMadCHook() will automatically remove the API hooks. But it will do so carefully to not cause deadlocks and it might leak some memory as a consequence of that. So using UninjectLibrary() is recommended because it can do the unhooking in a better way, without leaks and without risking deadlocks.

Re: Does FinalizeMadCHook Unhook all hooks?

Posted: Tue Mar 25, 2014 10:01 am
by blackpaw
Thanks madshi, good to know.