Thanks for the suggestion! I don't think it's correct though, because under Windows 10, it will still load if BaseAddress (module) has been modified, even if it's set to 0.
See the test case here: https://github.com/qsniyg/wine_dll_load_test , uncomment the BaseAddress = 0 line in dll2.c
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Thursday, April 2, 2020 12:57 AM, Ilie Halip ilie.halip@gmail.com wrote:
You could alternatively check if the IMAGE_FILE_DLL flag is set in the NT header, maybe something like this (not compiled, not tested):
--- a/dlls/ntdll/loader.c +++ b/dlls/ntdll/loader.c @@ -1309,7 +1309,14 @@ static NTSTATUS MODULE_InitDLL( WINE_MODREF *wm, UINT reason, LPVOID lpReserved
if (wm->ldr.Flags & LDR_DONT_RESOLVE_REFS) return STATUS_SUCCESS;
if (wm->ldr.TlsIndex != -1) call_tls_callbacks(
wm->ldr.BaseAddress, reason );
if (!entry || !(wm->ldr.Flags & LDR_IMAGE_IS_DLL)) return STATUS_SUCCESS;
if (!entry) return STATUS_SUCCESS;
if (!(wm->ldr.Flags & LDR_IMAGE_IS_DLL))
{
if (RtlImageNtHeader(module)->FileHeader.Characteristics &
IMAGE_FILE_DLL)
TRACE("... warning: mismatch between flags ... continuing
anyway ...");
else
return STATUS_SUCCESS;
}
if (TRACE_ON(relay)) {
Not sure which one is the better approach, though.