I guess GCC under linux puts the code into the .init/.fini sections in an ELF executable and under windows adds either hidden code into DllMain or it invokes it even before DllMain (somewhere near the entry point) and reacts to PROCESS_ATTACH/PROCESS_DETACH reasons passed as one of the arguments.....but it's a pure guess....