3

How can I close the file handle opened by a LoadLibrary call on a .dll while keeping the library loaded? FreeLibrary will not work for example.

In my case there is a program I want to keep open that has the DLL open, but I don't want to close the program each time I recompile and replace the DLL. I don't care if the program has an old version of the library in memory. The DLL is also used by another program which is why I want to be able to replace it.

0

1 Answer 1

7

It's not possible because a "loaded" DLL is a memory mapped file. This means that "closing the handle" would remove it from memory because it's not copied to memory, only mapped.

This is why DLLs are so memory efficient as long as all programs use the exact same file - it (almost) doesn't cost any extra memory to load it hundreds of times! (In case you wonder: it's mapped as copy-on-write so modifying it in memory won't modify the file on disk but instead copy the one affected 4k page to actual memory and modify it there.)

You can however rename the file (or move it, as long as it's on the same volume, which is technically also a renaming operation) while it's still in use. Then you can create a new file with the original name and later delete the old file after it was unloaded everywhere.

You can also mark the old file as to be deleted automatically on the next reboot using MoveFileEx(MOVEFILE_DELAY_UNTIL_REBOOT) but this requires elevated privileges. A popular choice by non-elevated updaters/uninstallers to avoid that is to drop a batch or vbs file in the local appdata folder that deletes the file and then itself (which does work because scripts are copied to memory) and register it in the per-user RunOnce registry key.

(Note that opening the file with FILE_FLAG_DELETE_ON_CLOSE won't work.)

4
  • Interesting, I did not know of memory mapped files before this. Thanks.
    – korri123
    Aug 31, 2020 at 22:06
  • 3
    FreeLibrary decrements the reference count on the library. It doesn't necessarily unload the module from the calling process' address space. This distinction is quite significant. Aug 31, 2020 at 22:18
  • 1
    There is no file handle to close. There isn't even a section (file mapping) handle to close. An HMODULE is the base address of the loaded module. In a kernel debugger you can use !vad <address> 1 to show information that includes the control area, which references the file object. In this case the file object only has kernel pointer references, no handle references. It's opened with FILE_SHARE_READ | FILE_SHARE_DELETE sharing, which is why it can be renamed, which requires opening the file with DELETE access.
    – Eryk Sun
    Sep 1, 2020 at 17:38
  • 1
    Opening an image-mapped DLL with delete-on-close fails the NtCreateFile system call with STATUS_CANNOT_DELETE (not STATUS_SHARING_VIOLATION) because the file is mapped as an image. For an example of code that checks for an active (non-flushable) image section, see FatOpenExistingFcb in the fastfat sample driver, which calls MmFlushImageSection.
    – Eryk Sun
    Sep 1, 2020 at 17:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.