The NT DLL loader: dynamic unloads

re: The NT DLL loader: dynamic unloads

LarryOsterman — Sun, 19 Jun 2005 16:14:44 GMT

How does delayload enter into the picture? When an EXE with delay load imports finally does load the DLL, is the newly loaded DLL pinned, or is it treated like LoadLibrary?

re: The NT DLL loader: dynamic unloads

mgrier — Sun, 19 Jun 2005 21:29:54 GMT

Delayload is coming. I'm trying to take a more organized approach to the brain dump I sent around internally. First I wanted to explain normal non-reentrant behavior and what quirks come out of it - specifically the ordering problems when cycles are in the graph.

Next I'm going to explain the ExitProcess() hazard; we have all the right tools to understand why not to do anything during ExitProcess() now.

Then I'm going to go into loader reentrancy, starting again with deadlocks and then going into the problems with reentrancy (including delayloads used during DLL_PROCESS_ATTACH / DLL_PROCESS_DETACH).

Then I'll finish up with the fact that sloppy error handling can tank the whole process when the code runs as part of DLL_PROCESS_ATTACH which will be exacerbated by the use of explicit (loadlibrary/getprocaddress) or implicit (linker delayloads) delay loading techniques.

re: The NT DLL loader: dynamic unloads

mgrier — Sun, 19 Jun 2005 21:38:38 GMT

After rereading Larry's comment and questions, I'll answer the pinning question.

Delayloads are just wrappers around dynamic loads. The loader doesn't know anything at all about them. The fact that they do have a standard form documenting them in the PE header is just to assist analysis tools like depends.exe.

Thus the answer is that they don't inherit any pinning. Because of the problem where you can't know who your caller is, it's not possible to implicitly pin delayloads from pinned DLLs.

nt dll

nt dll — Tue, 03 Jun 2008 22:58:58 GMT

PingBack from http://christopherhome.yourfreehosting.net/ntdll.html

mgrier s WebLog The NT DLL loader dynamic unloads | Weak Bladder

mgrier s WebLog The NT DLL loader dynamic unloads | Weak Bladder — Sat, 13 Jun 2009 03:05:41 GMT

PingBack from http://weakbladder.info/story.php?id=2492