Howto call MessageBox in dllmain

Question

I'm creating a little dll to use in a DLL-INJECTION POC (proof-of-concept). I'm using codeblocks' c++ ide.

My dll's main (dllmain) looks like this:

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
    MessageBox(0, "myfirstdll loaded", "SUCCESS STATUS", MB_OK);
    switch (fdwReason)
    {
        case DLL_PROCESS_ATTACH:
            // attach to process
            // return FALSE to fail DLL load
            break;
        case DLL_PROCESS_DETACH:
            // detach from process
            break;

        case DLL_THREAD_ATTACH:
            // attach to thread
            break;

        case DLL_THREAD_DETACH:
            // detach from thread
            break;
    }
    return TRUE; // succesful
}

Now, when I load the dll (using LoadLibrary) from a client program (hopefull, it loads!), my message box doesn't pop. This is quiet frustrating, since I'm doing a poc. I know about security issues that prevail when we do kernel32.dll, etc.-intensive business in dllmain, but then, my problem here is not security; i simply need to pop a message box right from within dllmain.

So, how can i make my message box pop when the dll is loaded ?

Use OutputDebugString() and SysInternals' DebugView utility. — Hans Passant

tenfour tenfour · Accepted Answer · 2011-12-04T18:41:21

See this question to read about the huge number of limitations in DllMain. It's not just security problems. Anything exported by user32 falls into this category.

In other words, you cannot use MessageBox in DllMain. Use something like OutputDebugString instead, which is in kernel32 and does not display any UI.

Howto call MessageBox in dllmain

2 Answers