Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Special Kernel Base Handling<br />
When the loader (Ntdll.dll) loads kernel base, it also calls<br />
LdrpSnapKernelBaseExtensions<br />
This parses all of the delay load descriptors for KernelBase.dll<br />
Looks for any which start with ext-<br />
Finds the API Set Hosts for those extensions, and checks if any resolve<br />
to Kernel32.dll<br />
◦ Load them if so, by calling LdrpResolveDelayLoadDescriptor<br />
1/26/2016 COPYRIGHT 2015 ALEX IONESCU. ALL RIGHTS RESERVED. 16
Change language