EasyHook Cleanup

Apr 16, 2013 at 4:00 PM
I need a robust mechanism to cleanup resourced opened by an injected DLL. In the EasyHook examples, it looks like cleanup is done within the finally clause of the Run() method...
public void Run(RemoteHooking.IContext InContext, String channelName) {
  try {
    while(ipcInterface.Ping(RemoteHooking.GetCurrentProcessId())) {
       // Do something useful
  catch {
  finally {
    // Cleanup code
However, when the host application ends, the finally code is not being executed. Is there a more robust way to detect the host application is ending to execute needed cleanup code?
Apr 18, 2013 at 12:33 PM
Have you tried AppDomain DomainUnload and ProcessExit events?
Apr 18, 2013 at 4:48 PM
Yes, I've tried the following four techniques...

1) Rely on the IPC ping failing like the EasyHook examples

2) Listen for AppDomain.CurrentDomain.DomainUnload events

3) Listen for Process.GetCurrentProcess().Exited events

4) Hook user32.dll SendMessage() and PostMessage() calls watching for WM_CLOSE, WM_QUIT, or WM_DESTROY messages

I'm injecting into a DirectX 9 game running in windowed mode (vs full screen mode). If I click the close button on the game's window, techniques #1 thru #3 do nothing but technique #4 above does give me notice the game is closing. If I instead though choose to exit the game through the game's menus, all four techniques above fail to give me notice and allow me to cleanup opened resources.
Apr 22, 2013 at 9:07 AM
I take it you are trying to cleanup stuff that is external to the application (e.g. not just memory etc...)?

If the application is ending most things will be taken care of anyway. If however you have data to flush to streams and so on I can see how this can cause a problem for you.