memlib icon indicating copy to clipboard operation
memlib copied to clipboard

Fix LdrLoadDll signature, support GetModuleHandleExW, EnumProcessModules

Open synap5e opened this issue 3 years ago • 0 comments

This was required to make the hooks work for me without crashing in some situations.

ReactOS has the type as PULONG https://doxygen.reactos.org/d7/d55/ldrapi_8c.html#a7671bda932dbb5096570f431ff83474c image

I also checked LoadLibraryExW (which is the implementation for all LoadLibrary*s) and when it calls LdrLoadDll it puts a reference into rdx. image (Although I have no idea why rcx (SearchPath) is ORed with 0x1 ...)

ntinternals and wine seem to say Flags is a ULONG. In wine, they just pass Flags from LoadLibrary* directly to LdrLoadDll rather than referencing.

synap5e avatar Jan 22 '22 23:01 synap5e