Thanks for the suggestion! I don't think it's correct though, because under Windows 10, it will still load if BaseAddress (module) has been modified, even if it's set to 0. See the test case here: https://github.com/qsniyg/wine_dll_load_test , uncomment the BaseAddress = 0 line in dll2.c ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Thursday, April 2, 2020 12:57 AM, Ilie Halip <ilie.halip(a)gmail.com> wrote:
You could alternatively check if the IMAGE_FILE_DLL flag is set in the NT header, maybe something like this (not compiled, not tested):
--- a/dlls/ntdll/loader.c +++ b/dlls/ntdll/loader.c @@ -1309,7 +1309,14 @@ static NTSTATUS MODULE_InitDLL( WINE_MODREF *wm, UINT reason, LPVOID lpReserved
if (wm->ldr.Flags & LDR_DONT_RESOLVE_REFS) return STATUS_SUCCESS;
if (wm->ldr.TlsIndex != -1) call_tls_callbacks(
wm->ldr.BaseAddress, reason );
- if (!entry || !(wm->ldr.Flags & LDR_IMAGE_IS_DLL)) return STATUS_SUCCESS;
- if (!entry) return STATUS_SUCCESS;
- if (!(wm->ldr.Flags & LDR_IMAGE_IS_DLL))
- {
- if (RtlImageNtHeader(module)->FileHeader.Characteristics &
IMAGE_FILE_DLL)
- TRACE("... warning: mismatch between flags ... continuing
anyway ...");
- else
- return STATUS_SUCCESS;
- }
if (TRACE_ON(relay)) {
Not sure which one is the better approach, though.