[Winpcap-users] WanPacket.cpp, DllMain, and LoadLibrary

[Bryan Kadzban]

I was recently looking into the WanPacket.dll sources (due to a long
delay when starting a process that used it - the delay didn't have to do
with it directly, but rather what else it loads, and what they do at
load time).  I am wondering why WanPacket.cpp does a LoadLibrary on
npp/ndisnpp.dll.  The DllMain documentation ([1]) says that calling
LoadLibrary from inside DllMain is prohibited, and a few technical
people at Microsoft agree ([2], [3], and [4]).  Plus, the module handle
that LoadLibrary returns is never used (it is checked in a couple
places, to ensure it's not NULL, but it isn't passed to GetProcAddress
or similar).

Is it only being loaded so that other functions can check whether it
exists before using it (presumably so they don't try to use it on
NT4/9x/ME)?  If that's the reason, then wouldn't it make more sense to
attempt the LoadLibrary at the start of those functions, and then do the
FreeLibrary right after checking the result?  (To keep the DLL lifetime
correct.)  Or have a separate static-linkage variable instead of the
module handle, and set it to 1 or 2 depending on whether LoadLibrary
works from any of these functions, so that you don't have to call it
more than once?  (Of course, you might not call it at all, depending on
the functions called by the program.)

(Both of these options would basically delay-load the DLL instead of
loading it at DllMain time.  I don't believe linking directly against it
is possible, since it's in the npp/ subdirectory of system32/.  But it
only hosts COM stuff anyway, and COM knows how to load it when needed,
so directly linking against it should not be required.)

Or am I missing something?

Thanks!

[1]
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/base/dllmain.asp

[2] http://blogs.msdn.com/larryosterman/archive/2004/04/23/118979.aspx

[3] http://blogs.msdn.com/oldnewthing/archive/2004/01/28/63880.aspx

[4] http://blogs.msdn.com/oleglv/archive/2003/12/12/43069.aspx