IMAGE_LOAD_CONFIG_DIRECTORY32结构的Reserved1字段中有什么?

时间:2016-10-07 04:58:21

标签: windows dll process loader portable-executable

查看kernelbase.dll的IMAGE_LOAD_CONFIG_DIRECTORY32结构,我看到以下内容:

compare_exchange_weak

`对于大多数系统DLL,看起来保留1字段设置为0x800。看起来这个字段的存在也会改变Ldrp的行为。有没有人知道这个字段是什么以及它中可能的标志值是什么?

1 个答案:

答案 0 :(得分:1)

行。我已经弄清楚了。 IMAGE_LOAD_CONFIG_DIRECTORY32中的Reserved1字段现在用于控制依赖模块的加载方式。到目前为止,我在系统dll中找到的唯一值是0x0800。当存在此标志时,仅在系统目录中搜索相关模块。

如果您对细节感兴趣,请继续阅读。

ModLoad: 4ef80000 4f041000   C:\vlh\pplus\builds\2016.09.23\OciVOB\DevInstall_debug\x86\cache\$Pcrt4.dll
    eax=00000000 ebx=00800000 ecx=01b6f6c1 edx=0000008c esi=00000000 edi=002e8000
    eip=77e6de8c esp=01b6f9c4 ebp=01b6fa20 iopl=0         nv up ei pl nz na po nc
    cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
    ntdll!NtMapViewOfSection+0xc:


// Module $Pcrt4 being mapped
0:003> kbn
 # ChildEBP RetAddr  Args to Child              
00 01b6f9c0 77e324c9 000000d8 ffffffff 0174d040 ntdll!NtMapViewOfSection+0xc        // Arg3 - Pointer to DllBase in  _LDR_DATA_TABLE_ENTRY (offset 18)
01 01b6fa20 77e3209a 01748590 00000000 0174d040 ntdll!LdrpMapViewOfSection+0x76     
02 01b6fa70 77e31fc7 00008020 01b6fa8c 0174bf10 ntdll!LdrpMapImage+0x40
03 01b6fa90 77e2ef85 c0000135 0174d028 0174bf10 ntdll!LdrpMapDllWithSectionHandle+0x20
04 01b6fae8 77e2f21d 77f0eb60 0174bf10 00000000 ntdll!LdrpMapDllNtFileName+0xde
05 01b6fc94 77e31ebf 4a35c2d6 77f0eb60 0174bf30 ntdll!LdrpMapDllSearchPath+0x1e1
06 01b6fce4 77e34d09 01b6feac 01744d78 01746878 ntdll!LdrpProcessWork+0x84
07 01b6fcf4 77e37538 01b6feac 00000000 01744d78 ntdll!LdrpWorkCallback+0x59
08 01b6fde4 77e363b6 01b6feac 01744df0 4a35c1b2 ntdll!TppWorkpExecuteCallback+0x1e8
09 01b6ff80 75ca62c4 01745940 75ca62a0 48108a65 ntdll!TppWorkerThread+0x396
0a 01b6ff94 77e60609 01745940 4a35c1ee 00000000 KERNEL32!BaseThreadInitThunk+0x24
0b 01b6ffdc 77e605d4 ffffffff 77e82516 00000000 ntdll!__RtlUserThreadStart+0x2f
0c 01b6ffec 00000000 77e36020 01745940 00000000 ntdll!_RtlUserThreadStart+0x1b

0:003> !dlls 0x0174d028

0x0174d028: C:\vlh\pplus\builds\2016.09.23\OciVOB\DevInstall_debug\x86\cache\$Pcrt4.dll
      Base   0x00000000  EntryPoint  0x00000000  Size        0x00000000    DdagNode     0x0174bfa8
      Flags  0x00000064  TlsIndex    0x00000000  LoadCount   0x00000001    NodeRefCount 0x00000000

// ldrDataTableEntry before loadConfig was processed
0:003> dt _LDR_DATA_TABLE_ENTRY 0x0174d028
ntdll!_LDR_DATA_TABLE_ENTRY
   +0x000 InLoadOrderLinks : _LIST_ENTRY [ 0x77f0ebec - 0x174cda0 ]
   +0x008 InMemoryOrderLinks : _LIST_ENTRY [ 0x77f0ebf4 - 0x174cda8 ]
   +0x010 InInitializationOrderLinks : _LIST_ENTRY [ 0x0 - 0x0 ]
   +0x018 DllBase          : (null) 
   +0x01c EntryPoint       : (null) 
   +0x020 SizeOfImage      : 0
   +0x024 FullDllName      : _UNICODE_STRING "C:\vlh\pplus\builds\2016.09.23\OciVOB\DevInstall_debug\x86\cache\$Pcrt4.dll"
   +0x02c BaseDllName      : _UNICODE_STRING "$Pcrt4.dll"
   +0x034 FlagGroup        : [4]  "d"
   +0x034 Flags            : 0x64
   +0x034 PackagedBinary   : 0y0
   +0x034 MarkedForRemoval : 0y0
   +0x034 ImageDll         : 0y1
   +0x034 LoadNotificationsSent : 0y0
   +0x034 TelemetryEntryProcessed : 0y0
   +0x034 ProcessStaticImport : 0y1
   +0x034 InLegacyLists    : 0y1
   +0x034 InIndexes        : 0y0
   +0x034 ShimDll          : 0y0
   +0x034 InExceptionTable : 0y0
   +0x034 ReservedFlags1   : 0y00
   +0x034 LoadInProgress   : 0y0
   +0x034 LoadConfigProcessed : 0y0
   +0x034 EntryProcessed   : 0y0
   +0x034 ProtectDelayLoad : 0y0
   +0x034 ReservedFlags3   : 0y00
   +0x034 DontCallForThreads : 0y0
   +0x034 ProcessAttachCalled : 0y0
   +0x034 ProcessAttachFailed : 0y0
   +0x034 CorDeferredValidate : 0y0
   +0x034 CorImage         : 0y0
   +0x034 DontRelocate     : 0y0
   +0x034 CorILOnly        : 0y0
   +0x034 ReservedFlags5   : 0y000
   +0x034 Redirected       : 0y0
   +0x034 ReservedFlags6   : 0y00
   +0x034 CompatDatabaseProcessed : 0y0
   +0x038 ObsoleteLoadCount : 6
   +0x03a TlsIndex         : 0
   +0x03c HashLinks        : _LIST_ENTRY [ 0x77f0ea68 - 0x77f0ea68 ]
   +0x044 TimeDateStamp    : 0
   +0x048 EntryPointActivationContext : (null) 
   +0x04c Lock             : (null) 
   +0x050 DdagNode         : 0x0174bfa8 _LDR_DDAG_NODE
   +0x054 NodeModuleLink   : _LIST_ENTRY [ 0x174bfa8 - 0x174bfa8 ]
   +0x05c LoadContext      : 0x0174bf10 _LDRP_LOAD_CONTEXT
   +0x060 ParentDllBase    : (null) 
   +0x064 SwitchBackContext : (null) 
   +0x068 BaseAddressIndexNode : _RTL_BALANCED_NODE
   +0x074 MappingInfoIndexNode : _RTL_BALANCED_NODE
   +0x080 OriginalBase     : 0
   +0x088 LoadTime         : _LARGE_INTEGER 0x0
   +0x090 BaseNameHashValue : 0xc03583f1
   +0x094 LoadReason       : 0 ( LoadReasonStaticDependency )
   +0x098 ImplicitPathOptions : 0
   +0x09c ReferenceCount   : 2
   +0x0a0 DependentLoadFlags : 0

// loadConfig Processing:
0:003> k
 # ChildEBP RetAddr  
00 01b6fa4c 77e3260f ntdll!LdrpCfgProcessLoadConfig+0x37
01 01b6fa78 77e31fe3 ntdll!LdrpProcessMappedModule+0x110
02 01b6fa90 77e2ef85 ntdll!LdrpMapDllWithSectionHandle+0x3c
03 01b6fae8 77e2f21d ntdll!LdrpMapDllNtFileName+0xde
04 01b6fc94 77e31ebf ntdll!LdrpMapDllSearchPath+0x1e1
05 01b6fce4 77e34d09 ntdll!LdrpProcessWork+0x84
06 01b6fcf4 77e37538 ntdll!LdrpWorkCallback+0x59
07 01b6fde4 77e363b6 ntdll!TppWorkpExecuteCallback+0x1e8
08 01b6ff80 75ca62c4 ntdll!TppWorkerThread+0x396
09 01b6ff94 77e60609 KERNEL32!BaseThreadInitThunk+0x24
0a 01b6ffdc 77e605d4 ntdll!__RtlUserThreadStart+0x2f
0b 01b6ffec 00000000 ntdll!_RtlUserThreadStart+0x1b

    ldrDataTableEntry.DependentLoadFlags = loadConfig.Reserved1;

// LdrpMapDllSearchPath looking at the ldrDataTableEntry.DependentLoadFlags
0:003> k
 # ChildEBP RetAddr  
00 01b6fc94 77e31ebf ntdll!LdrpMapDllSearchPath+0x259
01 01b6fce4 77e34d09 ntdll!LdrpProcessWork+0x84
02 01b6fcf4 77e37538 ntdll!LdrpWorkCallback+0x59
03 01b6fde4 77e363b6 ntdll!TppWorkpExecuteCallback+0x1e8
04 01b6ff80 75ca62c4 ntdll!TppWorkerThread+0x396
05 01b6ff94 77e60609 KERNEL32!BaseThreadInitThunk+0x24
06 01b6ffdc 77e605d4 ntdll!__RtlUserThreadStart+0x2f
07 01b6ffec 00000000 ntdll!_RtlUserThreadStart+0x1b

LdrpMapDllSearchPath()
{
77e2f28f 8b91a0000000    mov     edx,dword ptr [ecx+0A0h]                           //  edx = ldrDataTableEntry.DependentLoadFlags;
77e2f295 85d2            test    edx,edx                                            //  if(edx == 0) {
77e2f297 7520            jne     ntdll!LdrpMapDllSearchPath+0x27d (77e2f2b9)
77e2f299 e90afeffff      jmp     ntdll!LdrpMapDllSearchPath+0x6c (77e2f0a8)
-----------------------------------------------------------------------------------------------------------------------------------
77e2f0a8 6a50            push    50h                                                //      memset(pathConfig, 0, sizeof(pathConfig);
77e2f0aa 52              push    edx
77e2f0ab 8d842450010000  lea     eax,[esp+150h]
77e2f0b2 50              push    eax
77e2f0b3 e8d84e0400      call    ntdll!memset (77e73f90)
77e2f0b8 83a4246001000000 and     dword ptr [esp+160h],0
77e2f0c0 83c40c          add     esp,0Ch
77e2f0c3 83a4245801000000 and     dword ptr [esp+158h],0
77e2f0cb 8b4b08          mov     ecx,dword ptr [ebx+8]          
                                                                                    //  L1:
77e2f0ce 894c2424        mov     dword ptr [esp+24h],ecx                            //      
77e2f0d2 0fb6430c        movzx   eax,byte ptr [ebx+0Ch]
77e2f0d6 8d54241c        lea     edx,[esp+1Ch]
77e2f0da 52              push    edx
77e2f0db 8d542413        lea     edx,[esp+13h]
77e2f0df c1e803          shr     eax,3
77e2f0e2 52              push    edx
77e2f0e3 8d542418        lea     edx,[esp+18h]
77e2f0e7 83e001          and     eax,1
77e2f0ea 52              push    edx
77e2f0eb 8d542434        lea     edx,[esp+34h]
77e2f0ef 52              push    edx
77e2f0f0 8d542450        lea     edx,[esp+50h]
77e2f0f4 52              push    edx
77e2f0f5 8d54244c        lea     edx,[esp+4Ch]
77e2f0f9 52              push    edx
77e2f0fa 8bd1            mov     edx,ecx
77e2f0fc 8bcb            mov     ecx,ebx
77e2f0fe 50              push    eax
77e2f0ff e818100000      call    ntdll!LdrpSearchPath (77e3011c)                    //      LdrpSearchPath(...);
77e2f104 807c240f00      cmp     byte ptr [esp+0Fh],0
77e2f109 8bf8            mov     edi,eax
77e2f10b 0f85b9ae0500    jne     ntdll!LdrpMapDllSearchPath+0x5af8e (77e89fca)
                                                                                    //      ...

                                                                                    //  }
-----------------------------------------------------------------------------------------------------------------------------------
                                                                                    //  else {
77e2f2b9 8b4928          mov     ecx,dword ptr [ecx+28h]
77e2f2bc 8d842448010000  lea     eax,[esp+148h]
77e2f2c3 50              push    eax
77e2f2c4 83ca01          or      edx,1                                              //      dependentLoadFlags |= 1;
77e2f2c7 e895090100      call    ntdll!LdrpInitializeDllPath (77e3fc61)             //      LdrpInitializePath(...);
77e2f2cc 8d8c2448010000  lea     ecx,[esp+148h]
77e2f2d3 e9f6fdffff      jmp     ntdll!LdrpMapDllSearchPath+0x92 (77e2f0ce)         //      goto L1;
                                                                                    //  }
------------------------------------------------------------------------------------------------------------------------------------
}