LdrLoadDll Crash

I need to load a library via ntdll's LdrLoadDll function, in this case the library I am loading is user32.dll. However, when I try to load user32.dll, an access violation exception is thrown on the call(last line). I am unsure what the cause of this error could be. Am I creating the unicode string incorrectly?

LdrLoadDll

typedef (__stdcall *LdrLoadDll)(
IN PWCHAR PathToFile OPTIONAL,
IN ULONG Flags OPTIONAL,
IN PUNICODE_STRING ModuleFileName,
OUT PHANDLE ModuleHandle);
LdrLoadDll LdrLoadDllStruct = (LdrLoadDll)GetProcAddress(ntdllHandle, "LdrLoadDll");

typedef (__stdcall *RtlInitUnicodeString)(
PUNICODE_STRING DestinationString,
PCWSTR SourceString);
RtlInitUnicodeString RtlInitUnicodeStringStruct = (RtlInitUnicodeString)GetProcAddress(ntdllHandle, "RtlInitUnicodeString");

HMODULE hModule = 0;
UNICODE_STRING unicodestring;
RtlInitUnicodeStringStruct(&unicodestring, L"USER32.dll");
LdrLoadDllStruct(NULL, NULL, &unicodestring, &hModule);


NULL

GetProcAddress()

1 Answer
1

Here you go, some code that (a) actually compiles, and (b) works. Please excuse the (ahem) error handling:

#include <windows.h>
#include <subauth.h>
#include <assert.h>
#include <iostream>

#pragma comment (lib, "ntdll.lib")

typedef void (__stdcall *LdrLoadDll) (
IN PWCHAR PathToFile OPTIONAL,
IN ULONG Flags OPTIONAL,
IN PUNICODE_STRING ModuleFileName,
OUT HMODULE * ModuleHandle);

typedef void (__stdcall *RtlInitUnicodeString)(
PUNICODE_STRING DestinationString,
PCWSTR SourceString);

int main ()
{
HMODULE ntdllHandle = LoadLibrary (L"ntdll.dll");
assert (ntdllHandle);

LdrLoadDll LdrLoadDllStruct = (LdrLoadDll) GetProcAddress (ntdllHandle, "LdrLoadDll");
assert (LdrLoadDllStruct);
RtlInitUnicodeString RtlInitUnicodeStringStruct = (RtlInitUnicodeString) GetProcAddress (ntdllHandle, "RtlInitUnicodeString");
assert (RtlInitUnicodeStringStruct);

HMODULE hModule = 0;
UNICODE_STRING unicodestring;
RtlInitUnicodeStringStruct (&unicodestring, L"USER32.dll");
LdrLoadDllStruct (NULL, 0, &unicodestring, &hModule);
std::cout << hModule << "n";
}


Output (on my machine, 64 bit build):

00007FFF17C20000


Live demo.

And yet ... just what is wrong with using LoadLibrary()?

LoadLibrary()

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.