Sysinternals Homepage
Forum Home Forum Home > Windows Discussions > Development
  New Posts New Posts RSS Feed: LdrLoadDll in nt native api
  FAQ FAQ  Forum Search   Calendar   Register Register  Login Login

LdrLoadDll in nt native api
 Post Reply Post Reply Page  123>
Author
Message Reverse Sort Order
  Share Topic Share Topic  Topic Search Topic Search  Topic Options Topic Options
zahra34 View Drop Down
Newbie
Newbie


Joined: 25 August 2009
Location: teh
Online Status: Offline
Posts: 32 		Post Options Post Options   Quote zahra34 Quote  Post ReplyReply Direct Link To This Post Topic: LdrLoadDll in nt native api
    Posted: 06 November 2009 at 5:39am
hi
you are correct.maybe it has user mode dlls too that can not load them.I'm not sure.thanks for your reply
Back to Top
sepehrst View Drop Down
Newbie
Newbie


Joined: 06 October 2007
Location: teh
Online Status: Offline
Posts: 1 		Post Options Post Options   Quote sepehrst Quote  Post ReplyReply Direct Link To This Post Posted: 04 November 2009 at 5:21am
Hi
 
Does the dll your're trying to load, imports any dlls from user mod(win32 subsystem) land? (like kernel32, user32,...)
if so, then you will fail to load your dll.
To be able to load the dll in your native app, the dll must import ONLY ntdll.dll or other "native" dlls.
 
 
Back to Top
BanMe View Drop Down
Groupie
Groupie
Avatar

Joined: 18 August 2006
Location: United States
Online Status: Offline
Posts: 58 		Post Options Post Options   Quote BanMe Quote  Post ReplyReply Direct Link To This Post Posted: 28 August 2009 at 8:52pm
if your dll is in the 'systems' search path there is no need to specify one ;) just rely on the system being able to locate it.. so code such as this 




RtlInitUnicodeString(&Namedll, L"exampledll.dll");



status=LdrLoadDll(L"\\??\\C:\\WINDOWS\\system32", 0 , &Namedll, &mydll);
should work like this..


HMODULE mydll = 0;




RtlInitUnicodeString(&Namedll, L"exampledll.dll");



status=LdrLoadDll(0,0 , &Namedll, &mydll);
if this continues to fail, then you maybe just have to come up with a alternitive method of 'loading' it..if there is a problem with your Dll's DllMain or LibMain or w/e that could also be a problem.. try loading your dll into OllyDbg using the LoadDll feature present in version 1.10..if olly loads it properly then you can try the upper solution, otherwise you will have to recompile your dll.. ;)
 
regards BanMe 
Back to Top
zahra34 View Drop Down
Newbie
Newbie


Joined: 25 August 2009
Location: teh
Online Status: Offline
Posts: 32 		Post Options Post Options   Quote zahra34 Quote  Post ReplyReply Direct Link To This Post Posted: 27 August 2009 at 9:19pm
Originally posted by BanMe

is your dll in C:\Windows\System32 folder?...
 
also ntdll is already loaded you can traverse the PEB and get the modulehandle..to bypass this error..alternitivly you can contact me on msnLive an everyone else can spam the f**k outta me and we can work out another way.. rinna_marlen@hotmail.com is my email although I wont be on much today I will be on alot tommorow.. ;)
 
p.s. I'm also developing a Native Application..and have alot of time and research invested into it..and I usually know what im talking about...and alternatives..
 

Hi BanMe,

First,I should Thank you for your attention to my post :)

If  this post  becomes more  longer , I will contact You via your email, I think it is better to discuss about it here so that every one that has this problem in future can use it :)

 
Then, about path in system32 and the file, yes, my dll is in system32, but  I want to ask a question that may solve this problem. Is there any necessary properties for dll that I use in LdrLoadDll, for example any especial registry set that I did not attention about it? Or I  don’t know something that is prerequisite for this function?

Another thing which I want to know is,Can I use ZwLoadDriver/NtLoadDriver instead?to start working with a device?

As I see in these functions definition It is not very hard to use them . but I’m new in working with ZwLoadDriver..

 

thanks every body that helps me one time more
Back to Top
BanMe View Drop Down
Groupie
Groupie
Avatar

Joined: 18 August 2006
Location: United States
Online Status: Offline
Posts: 58 		Post Options Post Options   Quote BanMe Quote  Post ReplyReply Direct Link To This Post Posted: 27 August 2009 at 2:27pm
is your dll in C:\Windows\System32 folder?...
 
also ntdll is already loaded you can traverse the PEB and get the modulehandle..to bypass this error..alternitivly you can contact me on msnLive an everyone else can spam the f**k outta me and we can work out another way.. rinna_marlen@hotmail.com is my email although I wont be on much today I will be on alot tommorow.. ;)
 
p.s. I'm also developing a Native Application..and have alot of time and research invested into it..and I usually know what im talking about...and alternatives..
Back to Top
zahra34 View Drop Down
Newbie
Newbie


Joined: 25 August 2009
Location: teh
Online Status: Offline
Posts: 32 		Post Options Post Options   Quote zahra34 Quote  Post ReplyReply Direct Link To This Post Posted: 27 August 2009 at 1:23pm
What is the exact code you're using?
 
 
here is my code:


HANDLE mydll;


NTSTATUS status;


UNICODE_STRING Namedll;


RtlInitUnicodeString(&Namedll, L"exampledll.dll");


status=LdrLoadDll(L"\\??\\C:\\WINDOWS\\system32", 0 , &Namedll, &mydll);
for this code I get this error:c0000135 (STATUS_DLL_NOT_FOUND)
 
 
and code that works for ntdll.dll:




HANDLE mydll;


NTSTATUS status;


UNICODE_STRING Namedll;


RtlInitUnicodeString(&Namedll, L"ntdll.dll");


status=LdrLoadDll(NULL, 0 , &Namedll, &mydll);
for this one I get c0000005 that I said(it just works with ntdll.dll not another dll)
 
thanks for your help
 
Back to Top
wj32 View Drop Down
Senior Member
Senior Member
Avatar

Joined: 16 January 2009
Location: Australia
Online Status: Offline
Posts: 704 		Post Options Post Options   Quote wj32 Quote  Post ReplyReply Direct Link To This Post Posted: 27 August 2009 at 7:38am
What is the exact code you're using?
MCTS: Windows Internals
Process Hacker, a free and open source process viewer.
Back to Top
zahra34 View Drop Down
Newbie
Newbie


Joined: 25 August 2009
Location: teh
Online Status: Offline
Posts: 32 		Post Options Post Options   Quote zahra34 Quote  Post ReplyReply Direct Link To This Post Posted: 27 August 2009 at 7:12am
What error?
 
thanks for your interest,c0000005 (STATUS_ACCESS_VIOLATION)
 
 
 
 
 
Back to Top
ntunldr View Drop Down
Senior Member
Senior Member
Avatar

Joined: 05 July 2009
Online Status: Offline
Posts: 229 		Post Options Post Options   Quote ntunldr Quote  Post ReplyReply Direct Link To This Post Posted: 27 August 2009 at 6:00am
Originally posted by wj32

You can't use user-mode code in kernel-mode. That's a rule.


Offtop:

If ntdll rourtine uses call through sysenter/int 2e then it is impossible (you will have problems with sysexit), if you will change SharedUserData->CallRoutine (pointer to KiFastSystemCall) to point on KiIntSystemCall, then you can try to call some of ntdll.dll funcs from kernel mode. However this is perversion, but when somebody in kernel mode, there are no rules for them, only popular opinion.
Back to Top
wj32 View Drop Down
Senior Member
Senior Member
Avatar

Joined: 16 January 2009
Location: Australia
Online Status: Offline
Posts: 704 		Post Options Post Options   Quote wj32 Quote  Post ReplyReply Direct Link To This Post Posted: 26 August 2009 at 9:50pm
Originally posted by zahra34

thanks all  for reply

 

First off NtProcessStartup .. is still technically USER mode

you mean that before blue welcome screen is user mode??!!! I use my code in that area! if this is so, maybe I mismatch kernel with user :)

 

thanks alot for your codes BanMe. I did not understand your first code but for second one,as I see example shows:

 


Yes you did.

RtlInitUnicodeString(&Unicode,L"ntdll.dll");

as I declared before I aslo try ntdll.dll and its status is success but JUST FOR THIS DLL AND NOT ANOTHER DLLs,for other dlls it returns error


What error? Are you sure you're specifying the correct file name in native format?
MCTS: Windows Internals
Process Hacker, a free and open source process viewer.
Back to Top
 Post Reply Post Reply Page  123>

Forum Jump Forum Permissions View Drop Down