Windows Hooking and Dll Loading

Question

I am looking into reworking an old CBT windows hook, and am slightly confused as to how it is currently working. The way it is setup is one dll handles the Windows hooking and its logic, while another program calls into that dll when the hook should be set. It looks like this:

LRESULT CALLBACK HookProc(int nCode, WPARAM wParam, LPARAM lParam)
{
    return CallNextHookEx(NULL, nCode, wParam, lParam);
}

// this is the function the other program calls into
void InstallHook()
{
    // hdll is this dll's address
    SetWindowsHookEx(WH_CBT, HookProc, hDLL, 0);
}

Then we have our DllMain function. That dllmain function seems to get called whenever the hookProc function is invoked, and I do not understand this behavior. I've examined the fdwReason and it is getting called due to a dll process attach event.

How is this event being fired every time the HookProc is called? Since it is a global hook, I thought windows would load the dll and just persist it, calling the HookProc when the need arose. But from what I'm seeing, it acts like it is loaded back up anytime HookProc is called. Is this how it usually works, or could another part of the code base be causing this?

Answer 1

DLLs that implement global hooks get loaded into any process in the system that triggers the hook.

(This is precisely why global hooks must be implemented as DLLs - so they can be loaded into other processes).