Re: DLL Imports

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: L. Spiro (LSpiro_at_discussions.microsoft.com)
Date: 02/15/05 

Date: Tue, 15 Feb 2005 12:43:01 -0800

I mostly get this problem on a program that I myself have written, but also
on random others.
I wrote this program in question using Microsoft® Visual C++ .NET 7.1.3088,
with mostly normal project settings, except for optimizations.
What is interesting to note is that when I try to get the imports out of my
own program, when compiled for retail, it gets this invalid relative pointer
error 61 times, causing 61 imports to be unresolved, yet when I get the
imports from the same program compiled with my “debug” project options I only
fail to get 7 functions.

I get this problem with about 100 imports from Explorer.exe.

Again, most of the relative pointers work just fine, but in the array of
relative pointers there are sometimes these numbers with the 8th bit set.
There could be 5 good pointers, then 1 bad one, then 2 good, then 3 bad, or
whatever.
I have followed it all by hand and verified that these strange pointers are
indeed thrown into the list of good pointers.

When I get the imports from my first-mentioned program in retail and in
debug, the lists are the same, except that in the retail version there or a
lot more of the bad pointers.

My documentation doesn’t say anything about this.

Here is a little debug output.

Base Address: 01000000
Import Header Address: 01042AB0
This Header Address: 01042BB4
Characteristics: 00043238
Thunk: 000015D0
Original Thunk: 00043238
Address Pointed to by Characteristics: 0104323C->800000D7
Function Index: 1
DLL: SHLWAPI.dll loaded from C:\WINDOWS\Explorer.EXE

Base Address: 01000000
Import Header Address: 01042AB0
This Header Address: 01042BB4
Characteristics: 00043238
Thunk: 000015D0
Original Thunk: 00043238
Address Pointed to by Characteristics: 01043240->800000D9
Function Index: 2
DLL: SHLWAPI.dll loaded from C:\WINDOWS\Explorer.EXE

Base Address: 01000000
Import Header Address: 01042AB0
This Header Address: 01042BB4
Characteristics: 00043238
Thunk: 000015D0
Original Thunk: 00043238
Address Pointed to by Characteristics: 01043244->800001DC
Function Index: 3
DLL: SHLWAPI.dll loaded from C:\WINDOWS\Explorer.EXE

Base Address: 01000000
Import Header Address: 01042AB0
This Header Address: 01042BB4
Characteristics: 00043238
Thunk: 000015D0
Original Thunk: 00043238
Address Pointed to by Characteristics: 01043248->8000009D
Function Index: 4
DLL: SHLWAPI.dll loaded from C:\WINDOWS\Explorer.EXE

Base Address: 01000000
Import Header Address: 01042AB0
This Header Address: 01042BB4
Characteristics: 00043238
Thunk: 000015D0
Original Thunk: 00043238
Address Pointed to by Characteristics: 01043254->800000B0
Function Index: 7
DLL: SHLWAPI.dll loaded from C:\WINDOWS\Explorer.EXE

C:\WINDOWS\Explorer.EXE is the program that has the imports I am getting and
is loaded into RAM at address 0x01000000.
The first import header is at 0x01042AB0 and the current import header
descriptor is at 0x01042BB4.
In all of these examples, Explorer.exe is importing from SHLWAPI.dll.
In the last one, for example, Characteristics is pointing to address
01043254 (after adding 0x01000000).
After going to that address and reading the relative pointer stored there, I
get 800000B0.

In this trial, functions 0, 5, and 6 passed and 1, 2, 3, 4, and 7 gave these
crazy numbers.

Note that in all of the bad pointers, the 8th bit is set, and that they are
never the same number for each DLL.

But they do not appear to be ordinal numbers either.
I checked them with the function ordinals in SHLWAPI.dll and there are some
it does not have at all.

L. Spiro

Relevant Pages

  • Re: DLL Imports
    ... > Import Header Address: 01042AB0 ... > Original Thunk: 00043238 ... > Function Index: 1 ... > After going to that address and reading the relative pointer stored there, ...
    (microsoft.public.win32.programmer.kernel)
  • Re: Fat references
    ... traditional style of placing a header with GC metadata before every value ... So now you have references that can't fit into a machine register. ... Fat pointers have been implemented in some C compilers, ... run-time bounds checking on arrays and other objects. ...
    (comp.compilers)
  • Re: Header and Footer
    ... footers. ... header and the notation 'Page X' at the right margin of the header, ... hopefully the above will provide pointers. ... aaron is quite wrong to imagine that plain tex macros can carry ...
    (comp.text.tex)
  • Re: Fat references
    ... traditional style of placing a header with GC metadata before every value ... So now you have references that can't fit into a machine register. ... Fat pointers have been implemented in some C compilers, ... run-time bounds checking on arrays and other objects. ...
    (comp.compilers)
  • Re: misc/RFC: new EH mechanism...
    ... the item in question is the partial exception-handling ... 'PREL32' are basically base-relative pointers (they are relative to ... I guess the issue is using 8 bytes of header for each lump?... ... FOURCC magic; //'MLST' ...
    (alt.lang.asm)