Re: [PATCH 01/10] ntdll: Fixup imports after CREATE_PROCESS_DEBUG_EVENT.

[Alexandre Julliard]

Henri Verbeet  writes:
> diff --git a/dlls/ntdll/loader.c b/dlls/ntdll/loader.c
> index 1723f18..fbdda00 100644
> --- a/dlls/ntdll/loader.c
> +++ b/dlls/ntdll/loader.c
> @@ -2533,10 +2533,14 @@ PIMAGE_NT_HEADERS WINAPI RtlImageNtHeader(HMODULE hModule)
>   */
>  static NTSTATUS attach_process_dlls( void *wm )
>  {
> -
>
> LPCWSTR load_path;
> NTSTATUS status;
>
> pthread_sigmask( SIG_UNBLOCK, &server_block_set, NULL );
> -
>
> load_path = NtCurrentTeb()->Peb->ProcessParameters->DllPath.Buffer;
> -
>
> if ((status = fixup_imports( wm, load_path )) != STATUS_SUCCESS) return status;
> -
>
> RtlEnterCriticalSection( &loader_section );
>    if ((status = process_attach( wm, (LPVOID)1 )) != STATUS_SUCCESS)
>    {
>
> @@ -2622,7 +2626,6 @@ void WINAPI LdrInitializeThunk( void *kernel_start, ULONG_PTR unknown2,
>      static const WCHAR globalflagW[] = {'G','l','o','b','a','l','F','l','a','g',0};
>      NTSTATUS status;
>      WINE_MODREF *wm;
> - LPCWSTR load_path;
> PEB *peb = NtCurrentTeb()->Peb;
> IMAGE_NT_HEADERS *nt = RtlImageNtHeader( peb->ImageBaseAddress );
>
> @@ -2652,8 +2655,6 @@ void WINAPI LdrInitializeThunk( void *kernel_start, ULONG_PTR unknown2,
>      if ((status = server_init_process_done()) != STATUS_SUCCESS) goto error;
>  actctx_init();
> - load_path = NtCurrentTeb()->Peb->ProcessParameters->DllPath.Buffer;
> - if ((status = fixup_imports( wm, load_path )) != STATUS_SUCCESS) goto error;
> if ((status = alloc_process_tls()) != STATUS_SUCCESS) goto error;
> if ((status = alloc_thread_tls()) != STATUS_SUCCESS) goto error;
> heap_set_debug_flags( GetProcessHeap() );

You can't change the order of operations, for instance tls setup has to
be done after import fixup. Also I expect this will break Safedisc code
injection, you should add tests for the non-debugged case too.