[Coding] Successful API call and GetLastError

Started by fixer, May 23, 2017, 02:36:58 PM

Previous topic - Next topic


It's known that usually API functions upon unsuccessful return fill LastError value. And if function call was successful, this value isn't always set and can usually be ignored. Turns out, it's not always the case. Meet LdrLoadDll in Windows 10 Creators Update.

As you probably know, some text strings don't have to be hardcoded and can be links instead. For example in ShellClassInfo section of desktop.ini file InfoTip can be set to either explicit string or something like @Shell32.dll,-12688. It means take string resource from file. To resolve this link and get the string Windows loads this dll. And it boils down to LdrLoadDll call. The odd thing is that this call also relies on LastError value even if function returned STATUS_SUCCESS. In other words if LdrLoadDll returns STATUS_SUCCESS, but LastError is set to some value like ERROR_MOD_NOT_FOUND, Windows treats it as error and fails to resolve the link resulting in strange description like "@Shell32.dll,-12688". So don't forget to preserve LastError value if you hook this function.

Other Windows versions work fine. At the time of writing this issue isn't fixed.