A library loaded via LOAD_LIBRARY_AS_DATAFILE (or similar flags) doesn't get to play in any reindeer module games

Raymond Chen

If you load a library with the LOAD_LIBRARY_AS_DATA­FILE flag, then it isn’t really loaded in any normal sense. In fact, it’s kept completely off the books. If you load a library with the LOAD_LIBRARY_AS_DATA­FILE, LOAD_LIBRARY_AS_DATA­FILE_EXCLUSIVE, or LOAD_LIBRARY_AS_IMAGE_RESOURCE flag (or any similar flag added in the future), then the library gets mapped into the process address space, but it is not a true module. Functions like Get­Module­Handle, Get­Module­File­Name, Enum­Process­Modules and Create­Toolhelp32­Snapshot will not see the library, because it was never entered into the database of loaded modules. These “load library as…” flags don’t actually load the library in any meaningful sense. They just take the file and map it into memory manually without updating any module tracking databases. This functionality was overloaded into the Load­Library­Ex function, which in retrospect was probably not a good idea, because people expect Load­Library­Ex to create true modules, but these flags create pseudo-modules, a term I made up just now. It would have been less confusing in retrospect if the “load library as…” functionality were split into another function like Load­File­As­Pseudo­Module. Okay, that’s a pretty awful name, but that’s not the point. The point is to put the functionality in some function that doesn’t have the word library in its name. Okay, so now that we see that these pseudo-modules aren’t true modules, and they don’t participate in any reindeer module games. So what use are they? Basically, the only thing you can do with a pseudo-module is access its resources with functions like Find­Resource, Load­Resource, and Enum­Resource­Types. Note that this indirectly includes functions like Load­String, and Format­Message which access resources behind the scenes.

So maybe a better name for the function would have been Load­File­For­Resources, since that’s all the pseudo-module is good for.

Raymond Chen

Follow