Skip to content

Fix LdrLoadDll signature, support GetModuleHandleExW, EnumProcessModules #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

synap5e
Copy link

@synap5e synap5e commented Jan 22, 2022

This was required to make the hooks work for me without crashing in some situations.

ReactOS has the type as PULONG https://doxygen.reactos.org/d7/d55/ldrapi_8c.html#a7671bda932dbb5096570f431ff83474c
image

I also checked LoadLibraryExW (which is the implementation for all LoadLibrary*s) and when it calls LdrLoadDll it puts a reference into rdx.
image
(Although I have no idea why rcx (SearchPath) is ORed with 0x1 ...)

ntinternals and wine seem to say Flags is a ULONG. In wine, they just pass Flags from LoadLibrary* directly to LdrLoadDll rather than referencing.

@synap5e synap5e changed the title Fix LdrLoadDll signature (ULONG Flags -> PULONG Flags) Fix LdrLoadDll signature, support GetModuleHandleExW, EnumProcessModules Feb 20, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant