From: Myah Caron <qsniyg@protonmail.com>
Subject: Re: [PATCH v2] ntdll: Cache LDR_IMAGE_IS_DLL for InitDLL
Message-Id: <FmgX-daKqP1ySqmgCepIIlzBY1350GbCEq6XYDkukVzXDI7YoWPjQft8w1t8PuLsi1fGuJksRqh0rSy8uc6-ttWvcsPs_2uL4WxsfnuYfDA=@protonmail.com>
Date: Thu, 02 Apr 2020 19:45:48 +0000
In-Reply-To: <CAHFW8PQsEwAv=qUjoUMSR+FX1VtgpcPMHbLRDvXH8p+tL3Bt3A@mail.gmail.com>
References: <mxRzpqPG7BGy-DEN6YZsffCg4EYRIlWNnmUVuRj0GVvvA-zllPUyL2BD9je_uWu4TehTGFflg7Z8qlUKxZoQZV8HPZOTLkt75b-XI6X_7qQ=@protonmail.com> <CAHFW8PQsEwAv=qUjoUMSR+FX1VtgpcPMHbLRDvXH8p+tL3Bt3A@mail.gmail.com>

Thanks for the suggestion! I don't think it's correct though, because under Windows 10, it will still load if BaseAddress (module) has been modified, even if it's set to 0.

See the test case here: https://github.com/qsniyg/wine_dll_load_test , uncomment the BaseAddress = 0 line in dll2.c

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Thursday, April 2, 2020 12:57 AM, Ilie Halip <ilie.halip@gmail.com> wrote:

> You could alternatively check if the IMAGE_FILE_DLL flag is set in the
> NT header, maybe something like
> this (not compiled, not tested):
>
> --- a/dlls/ntdll/loader.c
> +++ b/dlls/ntdll/loader.c
> @@ -1309,7 +1309,14 @@ static NTSTATUS MODULE_InitDLL( WINE_MODREF
> *wm, UINT reason, LPVOID lpReserved
>
> if (wm->ldr.Flags & LDR_DONT_RESOLVE_REFS) return STATUS_SUCCESS;
>
>      if (wm->ldr.TlsIndex != -1) call_tls_callbacks(
>
>
> wm->ldr.BaseAddress, reason );
>
> -   if (!entry || !(wm->ldr.Flags & LDR_IMAGE_IS_DLL)) return STATUS_SUCCESS;
>
> -   if (!entry) return STATUS_SUCCESS;
>
> -   if (!(wm->ldr.Flags & LDR_IMAGE_IS_DLL))
>
> -   {
>
> -          if (RtlImageNtHeader(module)->FileHeader.Characteristics &
>
>
>
> IMAGE_FILE_DLL)
>
> -              TRACE("... warning: mismatch between flags ... continuing
>
>
>
> anyway ...");
>
> -          else
>
>
> -              return STATUS_SUCCESS;
>
>
> -   }
>
>     if (TRACE_ON(relay))
>     {
>
>     Not sure which one is the better approach, though.
>