PDA

View Full Version : why it stack is so strange?


kcynice
04-15-2008, 10:33 AM
I unpacked a dll file, but i found it could not be loaded by loadlibrary function. So, i traced it. I found the stack: [esp+8]=0,[esp+0c]=1 when it entered DllMain. But i traced a nother normal dll file, found the stack is so different: [esp+8]=1,[esp+0c]=0. And MSDN says the third param is unused, so [esp+0c]=0 should be correct. I think that's might be the problem.

I will be very appreciated if anybody would like to tell me why?

Regards,

kcynice
04-15-2008, 11:14 PM
I know, OllyDbg use LoadLibrary to load a dll file, so the default parameters should be (0x10000000,1,0), but why it's (0x100000000,0,1) for my unpacked dll?
Thanks

kcynice
04-16-2008, 02:24 AM
So, the dll only can be loaded by LoadLibraryEx function with DONT_RESOLVE_DLL_REFERENCES attribute. In this reason, the caller use LoadLibrary will fail. So, i want to know why?