Your DllMain function runs inside the loader lock, one of the few times the OS lets you run code while one of its internal locks is held. This means that you must be extra careful not to violate a lock hierarchy in your DllMain; otherwise, you are asking for a deadlock.
Windows Loader 2.2 1 By Daz Rar
The loader lock is taken by any function that needs to access the list of DLLs loaded into the process. This includes functions like GetModuleHandle and GetModuleFileName. If your DllMain enters a critical section or waits on a synchronization object, and that critical section or synchronization object is owned by some code that is in turn waiting for the loader lock, you just created a deadlock:
Loader refers to the OS (module) loader.Loader Lock is a system lock used by the loader to synchronize calls to DllMain.This way, the loader ensures that initialization / cleanup tasks required by DLLs are performed in a thread-safe manner.
(...) the operating system has its own internal process-specific lock that sometimes is held while your code executes. This lock is acquired when DLLs are loaded into the process, and is therefore called the 'loader lock.' The DllMain function always executes under the loader lock; (...)
I hav a Dell inspiron 3000 working on windows 10. I recently installed ubuntu 16.04. The problem is that now when I boot Grub boot loader gives the options and I'm not very fond of it. I would like the windows boot loader (the GUI). Pls help me with the steps to do so
If you are not fond of grub than you can try BURG. It has better GUI than the windows boot loader (Trust me on this one). You can select different themes for that as well. Also if you have dual booted your system then you can remove other options from the options screen and set just two options i.e WINDOWS and LINUX. To know how to install BURG here is the link :How to install BURG on Ubuntu 16.04
Everything when fine except that GRUB recognize the windows loader instead of each windows version, so if I need to boot into windows 7, I must first choose windows loader from GRUB and then choose windows 7 from windows loader.
I have read that the PE loader is responsible for loading executable images from disk. When and where is the control flow exactly transferred to the loader? The PE format is well documented but there seems to be a little info regarding the functioning of the loader itself.
The PE loader is exposed by a set of user APIs in kernel32.dll, under the CreateProcess family. There are different APIs for doing different things, e.g. running a process under an alternative security context.
The tricky part with your question is that the "loader" isn't really something that gets control flow. The instant you call CreateProcess, you're technically running the loader. However, the kernel part of the loader begins when ntdll!NtCreateUserProcess transitions into kernel-mode. If we're really strict about it, we might say that the first part of the loader is PspAllocateProcess, since that's what allocates the initial structures.
In the book Mastering Malware Analysis: The complete malware analyst's guide to combating malicious software, APT, cybercrime, and IoT attacks [Alexey Kleymenov, Amr Thabet], there're 2 sections in chapter 2 called "Process loading step by step" and "PE file loading step by step" which document how the Windows PE loader is loaded and how it works.
Below is a screenshot of one such file. This file, however, has no DOS stub at all and the DOS header data structures are all set to 0 except for e_lfanew which does point to a PE sig. However, the Windows loader says it's not a valid Win32 app at least on my version of Win7 64bit.
I do know that the loader essentially reads the data structures and from that, it does things such as allocate stack and heap memory, determine which symbols are needed and from which DLL files, as well as a few other tasks. So my assumption based off of that would be that if for example, one of these header data structures told the loader to do something that made no sense such as allocate negative space, too much space, or contained nonsense in a structure that was critical for the loader to work, it could crash it. However, this is just speculation on my part.
There are many ways in which the loader can fail to load a seemingly valid file. There are differences in rules for 32-bit and 64-bit architectures, for example. The most obvious of those is the minimum file size.
What's the best way to remove windows loader 2.2.1 by daz? I recently bootcamped my MacBook and bought a legit copy of windows, I just hadn't activated it yet and one day being bored at work (and mostly out of curiosity) activated my windows using the daz loader.
Plus im worried i could get in trouble through my company... how easy would it be for the computer department to see I am using a non payed for copy of windows considering I downloaded and installed the loader on my windows username that is on the company domain
So but it turns out that when I "uninstalled" the Windows partition, something didn't quite update in the boot loader (I'm kind of fuzzy on my knowledge of the difference between a boot loader and a boot manager, so I might be using these terms incorrectly). When I start up my Mac holding down option, I get the following...
In the end, I gave up on actually removing the entries from wherever they're stored on the bootloader. Instead, I just installed rEFInd and manually removed the entries from the bootloader. I chose to go this route because after installing Xubuntu, this was the only way that my mac could find the xubuntu bootup file and also rEFInd has a feature where you can specify which entries you want to display and which you don't.
Creating DLLs presents a number of challenges for developers. DLLs do not have system-enforced versioning. When multiple versions of a DLL exist on a system, the ease of being overwritten coupled with the lack of a versioning schema creates dependency and API conflicts. Complexity in the development environment, the loader implementation, and the DLL dependencies has created fragility in load order and application behavior. Lastly, many applications rely on DLLs and have complex sets of dependencies that must be honored for the applications to function properly. This document provides guidelines for DLL developers to help in building more robust, portable, and extensible DLLs.
DllMain is called while the loader-lock is held. Therefore, significant restrictions are imposed on the functions that can be called within DllMain. As such, DllMain is designed to perform minimal initialization tasks, by using a small subset of the Microsoft Windows API. You cannot call any function in DllMain that directly or indirectly tries to acquire the loader lock. Otherwise, you will introduce the possibility that your application deadlocks or crashes. An error in a DllMain implementation can jeopardize the entire process and all of its threads.
The ideal DllMain would be just an empty stub. However, given the complexity of many applications, this is generally too restrictive. A good rule of thumb for DllMain is to postpone as much initialization as possible. Lazy initialization increases robustness of the application because this initialization is not performed while the loader lock is held. Also, lazy initialization enables you to safely use much more of the Windows API.
It is important to note that the loader calls DllMain with the loader lock already acquired, so the loader lock should have the highest precedence in the locking hierarchy. Also note that code only has to acquire the locks it requires for proper synchronization; it does not have to acquire every single lock that is defined in the hierarchy. For example, if a section of code requires only locks A and C for proper synchronization, then the code should acquire lock A before it acquires lock C; it is not necessary for the code to also acquire lock B. Furthermore, DLL code cannot explicitly acquire the loader lock. If the code must call an API such as GetModuleFileName that can indirectly acquire the loader lock and the code must also acquire a private lock, then the code should call GetModuleFileName before it acquires lock P, thus ensuring that load order is respected.
Figure 2 is an example that illustrates lock order inversion. Consider a DLL whose main thread contains DllMain. The library loader acquires the loader lock L and then calls into DllMain. The main thread creates synchronization objects A, B, and G to serialize access to its data structures and then tries to acquire lock G. A worker thread that has already successfully acquired lock G then calls a function such as GetModuleHandle that attempts to acquire the loader lock L. Thus, the worker thread is blocked on L and the main thread is blocked on G, resulting in a deadlock.
If a DLL is unloaded after all its threads have been created, but before they begin executing, the threads may crash. If the DLL created threads in its DllMain as part of its initialization, some threads may not have finished initialization and their DLL_THREAD_ATTACH message is still waiting to be delivered to the DLL. In this situation, if the DLL is unloaded, it will begin terminating threads. However, some threads may be blocked behind the loader lock. Their DLL_THREAD_ATTACH messages are processed after the DLL has been unmapped, causing the process to crash.
A loader is code that prepares other code for execution. Loaders take data
corresponding to a program or library and prepare it to be read, modified, and/or executed. This preparation process typically involves steps such as parsing a file containing the code to be run, metadata about that code, and other relevant bits of information such as the external services it might need from other parts of the operating system. Additionally, things like resolving external dependencies - or other, external bits of code the bit being prepared will rely upon, setting memory protections appropriately, and perhaps updating references (if the code is not position independent) will happen here.
b2a8ae9291