DLL that was not present in memory despite not being formally unloaded
A DLL was still present in memory despite not being formally unloaded, due to a subtle behavior where the DLL's reference count never reached zero, preventing its removal from the process address space.
Background
- Raymond Chen is a veteran Microsoft engineer who writes "The Old New Thing" blog, a long-running deep-dive into Windows internals, quirks, and historical design decisions.
- This post describes a debugging mystery: a DLL existed on disk but was not present in a process's memory even though it had never been formally unloaded (FreeLibrary was never called).
- The explanation involves a subtle Windows loader behavior: when a DLL's DllMain returns FALSE (indicating failure to initialize), the loader automatically and silently removes the DLL from the process's module list, as if it was never loaded — even though LoadLibrary returned a success code in some edge cases.
- This is relevant to Windows system programmers and engineers doing crash analysis or forensic memory inspection, who might be confused by a missing module that their code "successfully" loaded.