修正在低版本系统上如果用户已经加载了一个用户目录下的指定名称的模块时,之后try_get_module函数并不能加载到系统目录下的该名称的模块的问题 #123
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
使用类似下面的示例:
先加载一个程序目录下的version.dll(如群文件中我提供的远程调试器压缩包中的versiXP.dll改名为version.dll),
然后调用YY-Thunks中实现的GetFileVersionInfosizeEx函数,会触发到try_get_module函数被调用,而在低版本系统上(如Windows2003),会导致触发到下图的代码:
即LdrLoadDll被调用,而目前代码会导致获取到的模块句柄是程序目录下的version.dll的(如上图中new_handle中值所示)
这并非程序所预期,因此算是个问题。
我这里的延申问题:
因为这里这个问题,在我Win2K3-New分支上,由于有下面这段代码:
会进行API函数指针返回值判断,如果函数是本模块中的就认为该系统下不存在该API,这里因为LdrLoadDll返回了用户目录下的version.dll中的实现(没直接指向本模块KernelEx.dll(YY-Thunks的容器)中的实现,本Windows2003系统目录下的version.dll已经修改,导出了
GetFileVersionInfoSizeExW=KernelEx.GetFileVersionInfoSizeExW
这个函数,即指向了KernelEx),因此被误认为该系统存在这个API了,因此出现了如下图的无限递归而崩溃的问题。