Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason.
Most of the time I use rundll32.exe to load and debug any DLL and I just get this behavior with a few binaries.
The current lib I am debugging is quite simple, most of the logic of the program is executed by a thread created at the DLL's entry point. Then, its single export(DllRegisterServer) has a loop which checks if a flag has been set to finally call ExitProcess.
When I enter the main's logic thread I suspend any other thread and single step through it as always. As I go, randomly the DLL is unloaded, reloaded, and the dbg sets me again at DllEntryPoint, which makes the RE job quite annoying.
What could be the reason for that behavior?
Edit: Within x64dbg this does not happen. Same file, same command line.
DLL_PROCESS_ATTACH
,DLL_PROCESS_DETACH
,DLL_THREAD_ATTACH
orDLL_THREAD_DETACH
, so maybe you're just getting thread notifications.