Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

好像不能加载user32.dll #11

Open
bennywingggg opened this issue Jul 8, 2022 · 7 comments
Open

好像不能加载user32.dll #11

bennywingggg opened this issue Jul 8, 2022 · 7 comments

Comments

@bennywingggg
Copy link

如题,加载user32.dll DLL_PROCESS_ATTACH失败,能找到函数,但会报访问无效地址的错误

@bb107
Copy link
Owner

bb107 commented Jul 8, 2022

#2

@bb107
Copy link
Owner

bb107 commented Jul 11, 2022

你好,请在加载前调用GetModuleHandle获取一下user32的句柄。如果能获取到,那么通过LoadLibraryMemory加载失败是正常的;如果获取不到并且加载失败请告诉我。如果问题解决了请关闭这个issue。
祝好。

@bennywingggg
Copy link
Author

bennywingggg commented Jul 11, 2022

感谢回复,试了下加载前调用GetModuleHandle获取user32的句柄为空,然后LoadLibraryMemory加载失败,调试了下,发现在导入Import Table时候加载了自己 ,LoadLibrary user32.dll导致的,这样的循环调用,是不是只要在导入Import Table时候不加载自己 ,还没有试

@bb107
Copy link
Owner

bb107 commented Jul 11, 2022

你用的哪个系统版本?

@bennywingggg
Copy link
Author

Win10 20H2

@bb107
Copy link
Owner

bb107 commented Jul 11, 2022

user32确实存在一条循环依赖路径:
user32 -> gdi32 -> gdi32full -> user32
我调整了一下加载的逻辑,把解析导入表挪到了插入LdrDataTableEntry之后,并且在我的系统上测试成功了

@bb107
Copy link
Owner

bb107 commented Jul 11, 2022

你需要在调用的时候使用正确的DllBaseName和DllFullName

    status = LdrLoadDllMemoryExW(
        &hModule,                               // ModuleHandle
        nullptr,                                // LdrEntry
        0,                                      // Flags
        buffer,                                 // Buffer
        0,                                      // Reserved
        L"user32.dll",                          // DllBaseName
        L"C:\\Windows\\System32\\user32.dll"    // DllFullName
    );

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants