Thread: Detect if a DLL is load time or run time

Is there a way to detect if a DLL is a Load Time DLL or a Run Time DLL?
If I use the FreeLibrary, and try to eject a Load Time DLL, the function still returns TRUE, so it succeeds even when the DLL is not ejected.
And besides, the FreeLibrary function is not really intended for this.
So how could I achieve to detect if a DLL, that used by a certain process, is a Load Time DLL or a Run Time DLL?

Thanks in advance, Ktulu.

Why exactly would you need to do that? I don't think it's possible.

To prevent people from Injecting DLL's into that certain process because they don't belong there, kind of anti-cheating shield.

I see. Nope, sorry, still not possible. However, what you could try is, at the start of the program, enumerate all loaded DLLs. If there's one in there that doesn't belong, kill the program. Every now and then, later (say every few seconds), you could do the same.

However, be warned: first, code that does that can rather easily be disabled by a crack patch. Second, several legitimate programs have a habit of injecting DLLs into everything. Virus scanners, for example. So if ever the program terminates because of an unknown DLL, make sure you display the name of that DLL somewhere where you can pick it up in reaction to support calls because the program won't work.
Of course, any malware could then simply disguise as one of the legitimate hook DLLs.

So as usual, it's always just a race between protection and the next crack that tricks it. Never forget: the code that's on the client computer is helpless against attacks.