Oleh Nykyforchyn oleh.nyk@gmail.com writes:
If fake 16 bit dll is found by create_mapping and status is set to STATUS_IMAGE_INVALID_WIN_16, do not release the mapping, but return it with WineFakeDll flag set to allow ntdll properly discover this dll by NtCreateSection and handle by find_dll_file.
That's very hackish. Besides, NtCreateSection is a public API, you can't change its behavior like that.