windows: Do not manually load ntdll.dll library

Per Windows Internals, Part 1, Image Loader section, the ntdll.dll library
is always loaded into every process on all NT systems.

So remove code which dynamically loads ntdll.dll library via LoadLibrary()
function and remove also code which changes error reporting mode (used just
for LoadLibrary) as both are not needed.

Also Microsoft C/C++ compilers optimize EXE applications in a way which
expects that the ntdll.dll library is loaded as the first module into the
process before the main EXE module itself.

diff --git a/lib/i386-io-windows.h b/lib/i386-io-windows.h
index 8f8cffdb8c7d1af271407e1326eecccafc56f8bb..898a781b6118df8c6983b6ddb672d79540581880 100644 (file)
--- a/lib/i386-io-windows.h
+++ b/lib/i386-io-windows.h
@@ -145,19 +145,11 @@ static BOOL
 SetProcessUserModeIOPL(VOID)
 {
   LPVOID Arg[2];
-  UINT prev_error_mode;
   HMODULE ntdll;
   BOOL ret;
 
-  /*
-   * Load ntdll.dll library with disabled critical-error-handler and
-   * file-not-found message box.
-   * It means that NT kernel does not show unwanted GUI message box to user
-   * when LoadLibrary() function fails.
-   */
-  prev_error_mode = win32_change_error_mode(SEM_FAILCRITICALERRORS | SEM_NOOPENFILEERRORBOX);
-  ntdll = LoadLibrary(TEXT("ntdll.dll"));
-  win32_change_error_mode(prev_error_mode);
+  /* Ntdll.dll is loaded into every process on all NT systems. */
+  ntdll = GetModuleHandle(TEXT("ntdll.dll"));
   if (!ntdll)
     {
       SetLastError(ERROR_INVALID_FUNCTION);
@@ -168,7 +160,6 @@ SetProcessUserModeIOPL(VOID)
   Arg[0] = (LPVOID)GetProcAddress(ntdll, "NtSetInformationProcess");
   if (!Arg[0])
     {
-      FreeLibrary(ntdll);
       SetLastError(ERROR_INVALID_FUNCTION);
       return FALSE;
     }
@@ -179,8 +170,6 @@ SetProcessUserModeIOPL(VOID)
   /* Call ProcessUserModeIOPL with Tcb privilege. */
   ret = win32_call_func_with_tcb_privilege(SetProcessUserModeIOPLFunc, (LPVOID)&Arg);
 
-  FreeLibrary(ntdll);
-
   if (!ret)
     return FALSE;
 

diff --git a/lib/physmem-windows.c b/lib/physmem-windows.c
index 06f094cb80d8234784e8c343cf4dc98b5578a37d..b220a781b4d91a7617a92d3d5557424fbe3ea0f6 100644 (file)
--- a/lib/physmem-windows.c
+++ b/lib/physmem-windows.c
@@ -145,7 +145,6 @@ typedef struct _OBJECT_ATTRIBUTES {
 #define DPMI_PHYSICAL_ADDRESS_MAPPING 0x0800
 
 struct physmem {
-  HMODULE ntdll;
   HANDLE section_handle;
   NTSTATUS (NTAPI *NtOpenSection)(PHANDLE SectionHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes);
   NTSTATUS (NTAPI *NtMapViewOfSection)(HANDLE SectionHandle, HANDLE ProcessHandle, PVOID *BaseAddress, ULONG_PTR ZeroBits, SIZE_T CommitSize, PLARGE_INTEGER SectionOffset, PSIZE_T ViewSize, SECTION_INHERIT InheritDisposition, ULONG AllocationType, ULONG Win32Protect);
@@ -667,49 +666,41 @@ init_physmem_ntdll(struct physmem *physmem, struct pci_access *a, const char *fi
   wchar_t *wide_filename;
   UNICODE_STRING unicode_filename;
   OBJECT_ATTRIBUTES attributes;
-  UINT prev_error_mode;
   NTSTATUS status;
+  HMODULE ntdll;
   int len;
 
   a->debug("resolving section functions from ntdll.dll...");
-  prev_error_mode = win32_change_error_mode(SEM_FAILCRITICALERRORS | SEM_NOOPENFILEERRORBOX);
-  physmem->ntdll = LoadLibrary(TEXT("ntdll.dll"));
-  win32_change_error_mode(prev_error_mode);
-  if (!physmem->ntdll)
+  ntdll = GetModuleHandle(TEXT("ntdll.dll"));
+  if (!ntdll)
     {
-      a->debug("failed: cannot open ntdll.dll library: %s.", win32_strerror(GetLastError()));
+      a->debug("failed: library ntdll.dll is not present.");
       errno = ENOENT;
       return 0;
     }
 
-  physmem->RtlNtStatusToDosError = (LPVOID)GetProcAddress(physmem->ntdll, "RtlNtStatusToDosError");
+  physmem->RtlNtStatusToDosError = (LPVOID)GetProcAddress(ntdll, "RtlNtStatusToDosError");
 
-  physmem->NtOpenSection = (LPVOID)GetProcAddress(physmem->ntdll, "NtOpenSection");
+  physmem->NtOpenSection = (LPVOID)GetProcAddress(ntdll, "NtOpenSection");
   if (!physmem->NtOpenSection)
     {
       a->debug("failed: function NtOpenSection() not found.");
-      FreeLibrary(physmem->ntdll);
-      physmem->ntdll = NULL;
       errno = ENOENT;
       return 0;
     }
 
-  physmem->NtMapViewOfSection = (LPVOID)GetProcAddress(physmem->ntdll, "NtMapViewOfSection");
+  physmem->NtMapViewOfSection = (LPVOID)GetProcAddress(ntdll, "NtMapViewOfSection");
   if (!physmem->NtMapViewOfSection)
     {
       a->debug("failed: function NtMapViewOfSection() not found.");
-      FreeLibrary(physmem->ntdll);
-      physmem->ntdll = NULL;
       errno = ENOENT;
       return 0;
     }
 
-  physmem->NtUnmapViewOfSection = (LPVOID)GetProcAddress(physmem->ntdll, "NtUnmapViewOfSection");
+  physmem->NtUnmapViewOfSection = (LPVOID)GetProcAddress(ntdll, "NtUnmapViewOfSection");
   if (!physmem->NtUnmapViewOfSection)
     {
       a->debug("failed: function NtUnmapViewOfSection() not found.");
-      FreeLibrary(physmem->ntdll);
-      physmem->ntdll = NULL;
       errno = ENOENT;
       return 0;
     }
@@ -733,8 +724,6 @@ init_physmem_ntdll(struct physmem *physmem, struct pci_access *a, const char *fi
   if (len <= 0)
     {
       a->debug("Option devmem.path '%s' is invalid multibyte string.", filename);
-      FreeLibrary(physmem->ntdll);
-      physmem->ntdll = NULL;
       errno = EINVAL;
       return 0;
     }
@@ -745,8 +734,6 @@ init_physmem_ntdll(struct physmem *physmem, struct pci_access *a, const char *fi
     {
       a->debug("Option devmem.path '%s' is invalid multibyte string.", filename);
       pci_mfree(wide_filename);
-      FreeLibrary(physmem->ntdll);
-      physmem->ntdll = NULL;
       errno = EINVAL;
       return 0;
     }
@@ -762,8 +749,6 @@ init_physmem_ntdll(struct physmem *physmem, struct pci_access *a, const char *fi
 
   if (status < 0 || physmem->section_handle == INVALID_HANDLE_VALUE)
     {
-      FreeLibrary(physmem->ntdll);
-      physmem->ntdll = NULL;
       physmem->section_handle = INVALID_HANDLE_VALUE;
       if (status == 0)
         a->debug("failed.");
@@ -853,8 +838,6 @@ physmem_close(struct physmem *physmem)
 {
   if (physmem->section_handle != INVALID_HANDLE_VALUE)
     CloseHandle(physmem->section_handle);
-  if (physmem->ntdll)
-    FreeLibrary(physmem->ntdll);
   pci_mfree(physmem);
 }
 

diff --git a/lib/win32-sysdbg.c b/lib/win32-sysdbg.c
index 6847fee00db32c836e97ec8f82ffa0c81b390929..93eeb6da4c3b8fcda8e3823eab25594f663a6ebf 100644 (file)
--- a/lib/win32-sysdbg.c
+++ b/lib/win32-sysdbg.c
@@ -85,7 +85,6 @@ static BOOL debug_privilege_enabled;
 static LUID luid_debug_privilege;
 static BOOL revert_only_privilege;
 static HANDLE revert_token;
-static HMODULE ntdll;
 
 static int win32_sysdbg_initialized;
 
@@ -117,20 +116,18 @@ win32_sysdbg_pci_bus_data(BOOL WriteBusData, BYTE BusNumber, BYTE DeviceNumber,
 static int
 win32_sysdbg_setup(struct pci_access *a)
 {
-  UINT prev_error_mode;
   NTSTATUS status;
+  HMODULE ntdll;
   ULONG ret_len;
   DWORD id;
 
   if (win32_sysdbg_initialized)
     return 1;
 
-  prev_error_mode = win32_change_error_mode(SEM_FAILCRITICALERRORS | SEM_NOOPENFILEERRORBOX);
-  ntdll = LoadLibrary(TEXT("ntdll.dll"));
-  win32_change_error_mode(prev_error_mode);
+  ntdll = GetModuleHandle(TEXT("ntdll.dll"));
   if (!ntdll)
     {
-      a->debug("Cannot open ntdll.dll library.");
+      a->debug("Library ntdll.dll is not present.");
       return 0;
     }
 
@@ -138,8 +135,6 @@ win32_sysdbg_setup(struct pci_access *a)
   if (!NtSystemDebugControl)
     {
       a->debug("Function NtSystemDebugControl() is not supported.");
-      FreeLibrary(ntdll);
-      ntdll = NULL;
       return 0;
     }
 
@@ -162,8 +157,6 @@ win32_sysdbg_setup(struct pci_access *a)
         a->debug("NT SysDbg is disabled.");
       else
         a->debug("NT SysDbg returned error 0x%lx.", status);
-      FreeLibrary(ntdll);
-      ntdll = NULL;
       NtSystemDebugControl = NULL;
       return 0;
     }
@@ -173,8 +166,6 @@ win32_sysdbg_setup(struct pci_access *a)
   if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid_debug_privilege))
     {
       a->debug("Debug privilege is not supported.");
-      FreeLibrary(ntdll);
-      ntdll = NULL;
       NtSystemDebugControl = NULL;
       return 0;
     }
@@ -182,8 +173,6 @@ win32_sysdbg_setup(struct pci_access *a)
   if (!win32_enable_privilege(luid_debug_privilege, &revert_token, &revert_only_privilege))
     {
       a->debug("Cannot enable Debug privilege.");
-      FreeLibrary(ntdll);
-      ntdll = NULL;
       NtSystemDebugControl = NULL;
       return 0;
     }
@@ -201,8 +190,6 @@ win32_sysdbg_setup(struct pci_access *a)
   revert_token = NULL;
   revert_only_privilege = FALSE;
 
-  FreeLibrary(ntdll);
-  ntdll = NULL;
   NtSystemDebugControl = NULL;
 
   if (status == STATUS_NOT_IMPLEMENTED || status == STATUS_INVALID_INFO_CLASS)
@@ -250,8 +237,6 @@ win32_sysdbg_cleanup(struct pci_access *a UNUSED)
       debug_privilege_enabled = FALSE;
     }
 
-  FreeLibrary(ntdll);
-  ntdll = NULL;
   NtSystemDebugControl = NULL;
 
   win32_sysdbg_initialized = 0;