1

Topic: Reasons ERROR_DLL_INIT_FAILED

Came up against a mysterious situation for itself. Is written by me simple dll. At the moment of a spelling all in it worked correctly. In general, wrote it, laid out for users, complaints were not, and I forgot about it. It was required to me to modify a little dll under new requests of users. And here something was opened mysterious. It appeared that in Windows 10 with all updates dll boots through time. More precisely, it correctly boots very rarely, and a normal situation is or ERROR_DLL_INIT_FAILED, or what AV where that in system. It happens only in Windows 10. In dllmain anything criminal does not become. I began to reduce functionality what to seize the moment in which dll it will be loaded normally. In what that the moment it happens. I compared import new dll and old - a difference in import of one function InternetCrackUrlW. I included the source code which has been disconnected in experiment, delivered a stub on InternetCrackUrlW (that it would not appear in import) - and, about a miracle, dll began to be loaded normally. But where logic? I where read that in Creators Update the loading mechanism dll has been optimized. Whether there can be my situation a consequence of it? Also noted that Delphi on which I write, sometimes in import places one and  function some times. It generally is lawful? How to search for the decision of such problem?

2

Re: Reasons ERROR_DLL_INIT_FAILED

A> I began to reduce functionality what to seize the moment in which dll it will be loaded normally. In what that the moment it happens. I compared import new dll and old - a difference in import of one function InternetCrackUrlW. I included the source code which has been disconnected in experiment, delivered a stub on InternetCrackUrlW (that it would not appear in import) - and, about a miracle, dll began to be loaded normally. But where logic? Very similar on actuating of heuristic rules  an antivirus: the size, lines and a dial-up , for example. A> How to search for the decision of such problem? If indirect anti-virus decisions are not present, for acknowledgement false positiv' it is necessary to look broad gulls Windows Defender. It should have a log, it is necessary to look at plus in system EventLog. That Windows Defender/SmartScreen would not swear at all it is possible to buy and sign the EV-digital signature (SmartScreen and certificate CodeSign EV, for example, it was considered). Or to experiment (to select safe , etc.).

3

Re: Reasons ERROR_DLL_INIT_FAILED

A> Is written by me simple dll. At the moment of a spelling all in it worked correctly. In general, wrote it, laid out for users, complaints were not, and I forgot about it. It was required to me to modify a little dll under new requests of users. And here something was opened mysterious. It appeared that in Windows 10 with all updates dll boots through time. More precisely, it correctly boots very rarely, and a normal situation is or ERROR_DLL_INIT_FAILED, or what AV where that in system. It happens only in Windows 10. In dllmain anything criminal does not become. I want will note that AV inside DllMain is caught SEH  the loader and upward the same gets out ERROR_DLL_INIT_FAILED So I suppose costs  this AV when it is visible

4

Re: Reasons ERROR_DLL_INIT_FAILED

Hello, Aniskin, you wrote: A> Is written by me simple dll. If it becomes in dllMain, sm https://msdn.microsoft.com/en-us/librar … p/dn633971 (v=vs.85).aspx

5

Re: Reasons ERROR_DLL_INIT_FAILED

Hello, EreTIk, you wrote: ETI> it is very similar to actuating of heuristic rules  an antivirus: the size, lines and a dial-up , for example. , let it will be native  an antivirus. But why arise AV? And after it process is not closed (it not probably to delete, and not probably to delete dll), but disappears from the manager of tasks. A>> how to search for the decision of such problem? ETI> if indirect anti-virus decisions are not present, for acknowledgement false positiv' it is necessary to look broad gulls Windows Defender. It should have a log, it is necessary to look at plus in system EventLog. In a system broad gull there are records which concern my problem, they look like: Faulting application name: Client.exe, version: 1.0.0.0, time stamp: 0x5a2532f2 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 Exception code: 0xc0000005 Fault offset: 0x36b436af Faulting process id: 0x1cb0 Faulting application start time: 0x01d36cfb217b489b Faulting application path: D:\Delphi\Projects\Test\Client.exe Faulting module path: unknown Report Id: ad90fc20-d29b-4052-af87-1a75389ca473 Faulting package full name: Faulting package-relative application ID: But it gives nothing to me.

6

Re: Reasons ERROR_DLL_INIT_FAILED

Hello, Sergey Mukhin, you wrote: the SM> if it becomes in dllMain SM sm> https://msdn.microsoft.com/en-us/librar … p/dn633971 (v=vs.85).aspx AV arise still to dllmain.

7

Re: Reasons ERROR_DLL_INIT_FAILED

A> Ok, let it will be native  an antivirus. But why arise AV? And after it process is not closed (it not probably to delete, and not probably to delete dll), but disappears from the manager of tasks. AV in the original message it was ACCESS_VIOLATION. , I not truly understood an essence of problem A> In a system broad gull there are records which concern my problem, they look like: A> Faulting application name: Client.exe, version: 1.0.0.0, time stamp: 0x5a2532f2 A> Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000 A> Exception code: 0xc0000005 A> Fault offset: 0x36b436af A> Faulting process id: 0x1cb0 A> Faulting application start time: 0x01d36cfb217b489b A> Faulting application path: D:\Delphi\Projects\Test\Client.exe A> Faulting module path: unknown A> Report Id: ad90fc20-d29b-4052-af87-1a75389ca473 A> Faulting package full name: A> Faulting package-relative application ID: A> But it gives nothing to me. So it is necessary to launch under a debugger (WinDbg, for example) and to look at a point of origin of an exception: that for the code by whom it is caused, etc.

8

Re: Reasons ERROR_DLL_INIT_FAILED

Hello, Aniskin, you wrote: A> How to search for the decision of such problem? A problem solved, but nevertheless its reasons for me are not clear till now. Delphi at creation of the import table for same dll can create a little IMAGE_IMPORT_DESCRIPTOR, and in everyone there will be the (can be even intersected) a dial-up of imported functions. In my case for wininet.dll there were two records IMAGE_IMPORT_DESCRIPTOR, in the first there was function InternetCrackUrlW, in the second InternetTimeFromSystemTimeW. Some manipulations with the code I achieved creation of one record with two functions. After that the problem disappeared. Found article, it describes changes in a loading technique dll in Windows 10 a little. However, in article problems are described at several records in the export table, instead of import, but is possible, at these problems the general beginning.

9

Re: Reasons ERROR_DLL_INIT_FAILED

Hello, EreTIk, you wrote: ETI> So it is necessary to launch under a debugger (WinDbg, for example) and to look at a point of origin of an exception: that for the code by whom it is caused, etc. I Write on Delphi, accordingly I use debugger Delphi. I see the following. After there was call LoadLibrary, but to a call dllmain happens AV. Where it is is specific - the data in a debugger is not present.

10

Re: Reasons ERROR_DLL_INIT_FAILED

Hello, Aniskin, you wrote: A> Hello, Aniskin, you wrote: A>> How to search for the decision of such problem? A> a problem solved, but nevertheless its reasons for me are not clear till now. A> Delphi at creation of the import table for same dll can create a little IMAGE_IMPORT_DESCRIPTOR, and in everyone there will be the (can be even intersected) a dial-up of imported functions. In my case for wininet.dll there were two records IMAGE_IMPORT_DESCRIPTOR, in the first there was function InternetCrackUrlW, in the second InternetTimeFromSystemTimeW. Some manipulations with the code I achieved creation of one record with two functions. After that the problem disappeared. Anything criminal, in several records for the same library in import, no. Look at the import table of any delphi a file with gui, there for certain at some records for kernel32.dll and user32.dll. In general, a situation regular. Most likely the problem in what that the friend, simply dared in passing.

11

Re: Reasons ERROR_DLL_INIT_FAILED

ETI>> So it is necessary to launch under a debugger (WinDbg, for example) and to look at a point of origin of an exception: that for the code by whom it is caused, etc. A> I Write on Delphi, accordingly I use debugger Delphi. I see the following. After there was call LoadLibrary, but to a call dllmain happens AV. Where it is is specific - the data in a debugger is not present. Many years any more did not see Delphi environment as debugging there looks and I do not remember already. It is necessary to take any debugger which can display system characters (inside ntdll.dll, kernelbase.dll, etc.) and debug information Delphi. Probably support Delphi and not to be necessary, if falling happens in system code. If the choice falls on WinDbg in entry line of commands (at the moment of catching target ACCESS_VIOLATION) it is necessary to enter something such:.symfix;! analyze-v

12

Re: Reasons ERROR_DLL_INIT_FAILED

Hello, enigmas, you wrote: E> Most likely the problem in what that the friend, simply dared in passing. I do not state that a problem in loader Windows. But the situation is that that dll which correctly booted to Creators Update ceased to boot with Creators Update in which there were changes in the loading mechanism dll. I will repeat, in dllmain there is nothing, except initialization of global structures. I can lay out this dll. If to whom or it is interesting, can look that happens at loading. At me on it knowledge does not suffice.

13

Re: Reasons ERROR_DLL_INIT_FAILED

A> I do not state that a problem in loader Windows. But the situation is that that dll which correctly booted to Creators Update ceased to boot with Creators Update in which there were changes in the loading mechanism dll. I will repeat, in dllmain there is nothing, except initialization of global structures. I can lay out this dll. If to whom or it is interesting, can look that happens at loading. At me on it knowledge does not suffice. And what  global objects with designers are, which are constructed __ dllmain (and as a matter of fact - in it)? I with  had for a long time no affairs, I do not remember as at it with it.

14

Re: Reasons ERROR_DLL_INIT_FAILED

Hello, Aniskin, you wrote: A> I do not state that a problem in loader Windows. But the situation is that that dll which correctly booted to Creators Update ceased to boot with Creators Update in which there were changes in the loading mechanism dll. I will repeat, in dllmain there is nothing, except initialization of global structures. I can lay out this dll. If to whom or it is interesting, can look that happens at loading. At me on it knowledge does not suffice. Lay out, it is desirable so that it could be launched without dances.

15

Re: Reasons ERROR_DLL_INIT_FAILED

Hello, mjau, you wrote: A>> I Can lay out this dll. If to whom or it is interesting, can look that happens at loading. At me on it knowledge does not suffice. M> lay out, it is desirable so that it could be launched without dances. The link. In archive two dll: good.eDecoder.32.dll - in this dll both functions from wininet.dll are in one IMAGE_IMPORT_DESCRIPTOR, and bad.eDecoder.32.dll, in which function from wininet.dll are in different IMAGE_IMPORT_DESCRIPTOR. This unique difference in libraries. Check very simple - to cause LoadLibrary for each library. At me good.* it is loaded correctly, bad.* - ERROR_DLL_INIT_FAILED, the exception is sometimes caught. Well and itself dll it is simple a plug-in for 7Zip.

16

Re: Reasons ERROR_DLL_INIT_FAILED

Hello, ononim, you wrote: O> And what  global objects with designers are which are constructed __ dllmain (and as a matter of fact - in it)? I with  had for a long time no affairs, I do not remember as at it with it. It is not clear that is meant the term "to dllmain". How my code can receive control to a call dllmain? Anyway in dllmain there is only a selection of a small amount of storage under the list and its filling.

17

Re: Reasons ERROR_DLL_INIT_FAILED

M>> lay out, it is desirable so that it could be launched without dances. A> the link. In archive two dll: good.eDecoder.32.dll - in this dll both functions from wininet.dll are in one IMAGE_IMPORT_DESCRIPTOR, and bad.eDecoder.32.dll, in which function from wininet.dll are in different IMAGE_IMPORT_DESCRIPTOR. This unique difference in libraries. Check very simple - to cause LoadLibrary for each library. At me good.* it is loaded correctly, bad.* - ERROR_DLL_INIT_FAILED, the exception is sometimes caught. Well and itself dll it is simple a plug-in for 7Zip. Windows 10.0.15063 - it is not shown Windows 10.0.16299 - it is not shown Probably, for playback it is necessary also the specific EXE file causing LoadLibrary?

18

Re: Reasons ERROR_DLL_INIT_FAILED

Hello, EreTIk, you wrote: ETI> ETI> Windows 10.0.15063 - it is not shown ETI> Windows 10.0.16299 - Thanks for the information are not shown ETI>. And  systems what? At me x64. ETI> it is possible, for playback it is necessary also the specific EXE file causing LoadLibrary? At me any application that itself 7zip that the simple program fulfilling unique LoadLibrary play back a problem.

19

Re: Reasons ERROR_DLL_INIT_FAILED

Hello, Aniskin, you wrote: A>>> I Can lay out this dll. If to whom or it is interesting, can look that happens at loading. At me on it knowledge does not suffice. M>> lay out, it is desirable so that it could be launched without dances. A> the link. In archive two dll: good.eDecoder.32.dll - in this dll both functions from wininet.dll are in one IMAGE_IMPORT_DESCRIPTOR, and bad.eDecoder.32.dll, in which function from wininet.dll are in different IMAGE_IMPORT_DESCRIPTOR. This unique difference in libraries. Check very simple - to cause LoadLibrary for each library. At me good.* it is loaded correctly, bad.* - ERROR_DLL_INIT_FAILED, the exception is sometimes caught. Well and itself dll it is simple a plug-in for 7Zip. At me bad it is loaded normally, probably at you purely local or  a rake.

20

Re: Reasons ERROR_DLL_INIT_FAILED

Hello, mjau, you wrote: M> at you purely local or  a rake. Probably you are right. Specially delivered on  pure ten - it is not played back. I will hope that I unique such loser with such combination of iron and a software.

21

Re: Reasons ERROR_DLL_INIT_FAILED

Hello, Aniskin, you wrote: O>> And what  global objects with designers are which are constructed __ dllmain (and as a matter of fact - in it)? I with  had for a long time no affairs, I do not remember as at it with it. A> it is not clear that is meant the term "to dllmain". How my code can receive control to a call dllmain? Anyway in dllmain there is only a selection of a small amount of storage under the list and its filling. Actually at loading dll the code call "DllMainImpl" is produced, from  designers of global objects and  are caused. And only then control from it is transferred in DllMain. This DllMainImpl is given  by library of your development environment

22

Re: Reasons ERROR_DLL_INIT_FAILED

Hello, Marty, you wrote: M> Actually at loading dll the code call "DllMainImpl" is produced It is specificity  ? Google on demand "DllMainImpl" does not give anything.

23

Re: Reasons ERROR_DLL_INIT_FAILED

Hello, Aniskin, you wrote: M>> Actually at loading dll the code call "DllMainImpl" A> is produced It is specificity  ? Google on demand "DllMainImpl" does not give anything. It is specificity practically any  to which need to initialize global objects and to produce other similar actions. "DllMainImpl" I from  invented a name

24

Re: Reasons ERROR_DLL_INIT_FAILED

Hello, ononim, you wrote: O> I Want will note that AV inside DllMain is caught SEH  the loader and upward the same gets out ERROR_DLL_INIT_FAILED It like  the exception code, that is will be STATUS_ACCESS_VIOLATION == EXCEPTION_ACCESS_VIOLATION == 0xC000'0005 (so, it is possible to receive interesting result, throwing SEH-zero therefrom)

25

Re: Reasons ERROR_DLL_INIT_FAILED

A> Thanks for the information. And  systems what? At me x64. Too 64 bit.