LoadLibraryEx / LOAD_LIBRARY_AS_IMAGE_RESOURCE

[lallous]

Hello,

When I LoadLibraryEx with LOAD_LIBRARY_AS_IMAGE_RESOURCE flag, the
returned hMod flag is the normal image base value + 2.

Example: LoadLibrary("f.dll") -> base = 0x10000000
LoadLibraryEx("f.dll", LOAD_LIBRARY_AS_IMAGE_RESOURCE) -> base =
0x10000002

It is a bit misleading because I am trying to find the RVA of a given
resource and if I use the hMod I will get an off by two RVA.

(The flag DONT_RESOLVE_DLL_REFERENCES works fine, but what about the
aforementioned flag?)

Please advise.

--
Elias

[RossettoeCioccolato]

This is by design. The module handle returned by LoadLibraryEx() is
supposed to be opaque, so MS is free to do whatever it wants with it. The
fact that the module handle is the base address on x86 and x64 platforms is
undocumented. If you want to rely on this undocumented behaviour (which a
lot of programmers do) you will need to mask off the flag bits in the module
handle before calculating the RVA.

[rogero]

Post by lallous
Hello,
When I LoadLibraryEx with LOAD_LIBRARY_AS_IMAGE_RESOURCE flag, the
returned hMod flag is the normal image base value + 2.
Example: LoadLibrary("f.dll") -> base = 0x10000000
LoadLibraryEx("f.dll", LOAD_LIBRARY_AS_IMAGE_RESOURCE) -> base =
0x10000002
It is a bit misleading because I am trying to find the RVA of a given
resource and if I use the hMod I will get an off by two RVA.
(The flag DONT_RESOLVE_DLL_REFERENCES works fine, but what about the
aforementioned flag?)
Please advise.
--
Elias

Not entirely sure I understand what you're trying to do...
but perhaps you can use the MapAndLoad function instead (from
imagehlp)?
And then use other functions, such as ImageRvaToVa(), to navigate
round the data.

Regards,
Roger.