Implementing DllMain Parser

Network Monitor uses the DllMain export function to identify the existence of the parser, and release resources that Network Monitor uses to store information about the parser.

When Network Monitor calls DllMain for the first time, the parser DLL calls CreateProtocol to do the following:

• Specify the protocol that the parser detects.
• Provide entry points for remaining parser export functions that Network Monitor calls.

When Network Monitor calls DllMain for the last time, DllMain calls DestroyProtocol to release all resources that Network Monitor uses to store information about the parser.

The following procedure identifies the steps necessary to implement DllMain.

To implement DllMain

1. Specify the ENTRYPOINTS structure for the CreateProtocol function and global Attach variable. The Attach variable is used to track the number of protocol instances that are running.

2. Look at the value of the Command parameter that the operating system sets.

   If the Command parameter is set to DLL_PROCESS_ATTACH and Attach is 0, then call CreateProtocol to provide the protocol name and entry points for the following export functions.

   • Register
   • Deregister
   • RecognizeFrame
   • AttachProperties
   • FormatProperties (only required if Network Monitor will be displaying the protocol properties).

   If the Command parameter is set to DLL_PROCESS_DETACH and Attach is 0, then call DestroyProtocol using the instance handle that CreateProtocol returns.

3. Return TRUE because the DllMain parser function must always return TRUE.

The following is a basic implementation of DllMain. The code example uses a case statement to trap values of the Command parameter to determine if CreateProtocol or DestroyProtocol should be called.

#include <windows.h>

// Entry point structure for parser export functions and global
// Attach variable.
ENTRYPOINTS EntryPoints =
{
  Register,
  Deregister,
  RecognizeFrame,
  AttachProperties,
  FormatProperties
};

DWORD Attached = 0; 

BOOL WINAPI DllMain(HANDLE hInstance, ULONG Command, LPVOID Reserved)
{
  switch(Command)
  {
  // Call CreateProtocol.
  case DLL_PROCESS_ATTACH:
       // Loading parser DLL.
       if(Attached == 0)
       {
         hProtocol = CreateProtocol( "ProtocolName",
                                     &EntryPoints,
                                     ENTRYPOINTS_SIZE);
       }
       Attached++;
       break;
  // Call DestroyProtocol.
  case DLL_PROCESS_DETACH:
       // Unloading parser DLL.
       Attached--;
       if(Attached == 0)
       {
         DestroyProtocol( hProtocol);
       }
       break;
  }
  return TRUE;
}