Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTDEV

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Appinit_DLLs registry key

OSR_Community_UserOSR_Community_User Member Posts: 110,217
Hi,
I want to laod a DLL in all process and therefore I made a entry for
that DLL under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
NT\CurrentVersion\Windows\appinit_dlls. But the problem is that this entry
is not accessed by NT while starting a new process. I monitored this through
regmon tool from sysinternals.com. From KB 197571, process must link to
user32.dll from where LoadLibrary is called for all DLLs listed under the
above key but this is not happening. The key is not accessed and hence DLL
is not loaded.
Any Idea about the problem.
Thanks
Ashish

Comments

  • Appinit_DLLs registry keyDid you reboot? You have to reboot before this will work correctly. This is one of the downsides of using this feature.

    Scott Meeuwsen
    High Level Software, Ltd.
    ----- Original Message -----
    From: Ashish_Goyal
    To: NT Developers Interest List
    Sent: Thursday, April 27, 2000 8:54 AM
    Subject: [ntdev] Appinit_DLLs registry key


    Hi,
    I want to laod a DLL in all process and therefore I made a entry for that DLL under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\appinit_dlls. But the problem is that this entry is not accessed by NT while starting a new process. I monitored this through regmon tool from sysinternals.com. From KB 197571, process must link to user32.dll from where LoadLibrary is called for all DLLs listed under the above key but this is not happening. The key is not accessed and hence DLL is not loaded.

    Any Idea about the problem.
    Thanks
    Ashish
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Thanks, It worked.
    Actually initially I entered full path and rebooted but from KB197571 I came
    to know that NT reads only first 32 Characters and so I changed the name and
    forgot to reboot. But this also shows problem with Regmon.exe since it does
    not show that the AppInit_DLLs registry key is accessed(after rebooting
    also). Does this indicate bug in Regmon.exe ?

    Thanks
    Ashish


    -----Original Message-----
    From: Scott Meeuwsen [mailto:[email protected]]
    Sent: Thursday, April 27, 2000 7:19 PM
    To: NT Developers Interest List
    Subject: [ntdev] Re: Appinit_DLLs registry key


    Did you reboot? You have to reboot before this will work correctly. This
    is one of the downsides of using this feature.

    Scott Meeuwsen
    High Level Software, Ltd.

    ----- Original Message -----
    From: Ashish_Goyal
    To: NT Developers Interest List
    Sent: Thursday, April 27, 2000 8:54 AM
    Subject: [ntdev] Appinit_DLLs registry key


    Hi,
    I want to laod a DLL in all process and therefore I made a entry for
    that DLL under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
    NT\CurrentVersion\Windows\appinit_dlls. But the problem is that this entry
    is not accessed by NT while starting a new process. I monitored this through
    regmon tool from sysinternals.com. From KB 197571, process must link to
    user32.dll from where LoadLibrary is called for all DLLs listed under the
    above key but this is not happening. The key is not accessed and hence DLL
    is not loaded.

    Any Idea about the problem.
    Thanks
    Ashish
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    > Actually initially I entered full path and rebooted but from
    > KB197571 I came to know that NT reads only first 32 Characters
    > and so I changed the name and forgot to reboot. But this also
    > shows problem with Regmon.exe since it does not show that the
    > AppInit_DLLs registry key is accessed(after rebooting also).
    > Does this indicate bug in Regmon.exe ?

    NT probably reads it once during startup and caches the info. This explains
    why you have to reboot.

    - Danilo
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 January 2023 Live, Online
Developing Minifilters 20 March 2023 Live, Online
Internals & Software Drivers 17 April 2023 Live, Online
Writing WDF Drivers 22 May 2023 Live, Online