Notes on the use of the loader lock in Windows XP (SP1) _LdrpInitialize@12 (2 references to LdrpLoaderLock) Description - Acquires the loader lock via RtlTryEnterCriticalSection or, if the loader lock is not yet initialized, RtlEnterCriticalSection. _LdrpInitializeProcess@20 (3 references to LdrpLoaderLock) Description - Adds the loader lock to the critical section list. Internal NTDLL references to LdrpInitializeProcess LdrpInitialize LdrShutdownProcess (73) (1 reference to LdrpLoaderLock) Description - Acquires the loader lock via RtlEnterCriticalSection if the process is not already shutting down. External references to LdrShutdownProcess KERNEL32.DLL ExitProcess LdrShutdownThread (74) (1 reference to LdrpLoaderLock) Description - Acquires the loader lock via RtlEnterCriticalSection. External references to LdrShutdownThread KERNEL32.DLL ExitThread _LdrpForkProcess@0 (3 references to LdrpLoaderLock) Description - Updates the loader lock by adding the FastPebLock after it to the critical section list. Internal NTDLL references to LdrpForkProcess LdrpInitialize LdrLockLoaderLock (67) (2 references to LdrpLoaderLock) 3 parameters Internal NTDLL references to LdrLockLoaderLock LdrAddRefDll External references KERNEL32.DLL BasepGetModuleHandleEx LdrDisableThreadCalloutsForDll External references KERNEL32.DLL DisableThreadLibraryCalls SFCFILES.DLL LdrEnumerateLoadedModules External references KERNEL32.DLL LoadLibraryExW LdrFlushAlternateResourceModules External references USER32.DLL WINSRV.DLL LdrGetDllHandleEx (via LdrGetDllHandle) KERNEL32.DLL LoadLibraryExW BasepGetModuleHandleEx LdrInitShimEngineDynamic External references SHIMENG.DLL LdrLoadAlternateResourceModule External references KERNEL32.DLL LoadLibraryExW LdrLoadDll - no corresponding call, buried in internal routine External references KERNEL32.DLL LoadLibraryExW SetConsolePalette CreateProcessInternalW LSASRV.DLL SAMSRV.DLL SFC_OS.DLL SHIMENG.DLL SMSS.EXE VERIFIER.DLL LdrSetAppCompatDllRedirectionCallback LdrUnloadAlternateResourceModule External references KERNEL32.DLL FreeLibrary RtlPcToFileHeader External references KERNEL32.DLL BasepGetModuleHandleEx USER32.DLL WOW32.DLL RtlQueryInformationActivationContext RtlQueryInformationActivationContext External references KERNEL32.DLL CreateRemoteThread QueryActCtx QueueUserAPC External references to LdrLockLoaderLock FAULTREP.DLL KERNEL32.DLL BasepGetModuleHandleExW GetModuleFileNameW UnhandledExceptionFilter MSCTF.DLL LdrUnlockLoaderLock (77) (2 references to LdrpLoaderLock) 2 parameters Internal NTDLL references to LdrUnlockLoaderLock (For external references see LdrLockLoaderLock) LdrAddRefDll LdrDisableThreadCalloutsForDll LdrEnumerateLoadedModules LdrFlushAlternateResourceModules LdrGetDllHandleEx LdrInitShimEngineDynamic LdrLoadAlternateResourceModule LdrLoadDll LdrSetAppCompatDllRedirectionCallback LdrUnloadAlternateResourceModule RtlPcToFileHeader RtlQueryInformationActivationContext - 2 LdrLockLoaderLock calls External references to LdrUnlockLoaderLock FAULTREP.DLL KERNEL32.DLL BasepGetModuleHandleExW GetModuleFileNameW UnhandledExceptionFilter MSCTF.DLL _LdrpLoadDll@24 (1 reference to LdrpLoaderLock) Description - Acquires the loader lock via RtlEnterCriticalSection if the process is not in loader initialization. Internal NTDLL references to LdrpLoadDll LdrLoadDll LdrpInitializeProcess LdrpLoadShimEngine LdrpSnapThunk LdrUnloadDll (76) (1 reference to LdrpLoaderLock) Description - Acquires the loader lock via RtlEnterCriticalSection if the process is not in loader initialization. Internal NTDLL references to LdrUnloadDll PropertyLengthAsVariant RtlConvertPropertyToVariant RtlConvertVariantToProperty ImportTablepHashCanonicalLists LdrpCodeAuthzCheckDllAllowed LdrpCorUnloadImage LdrpCorValidateImage LdrpLoadDll LdrpUnloadShimEngine External references to LdrUnloadDll BASESRV.DLL CSRSRV.DLL KERNEL32.DLL BasepCheckBadapp BasepCheckWinSaferRestrictions BasepReplaceProcessThreadTokens FreeLibrary FreeLibraryAndExitThread SAMSRV.DLL SFC_OS.DLL SHIMENG.DLL SMSS.EXE VERIFIER.DLL _LdrpGetProcedureAddress@20 (1 reference to LdrpLoaderLock) Description - Acquires the loader lock via RtlEnterCriticalSection if the process is not in loader initialization. Internal NTDLL references to LdrpGetProcedureAddress LdrGetProcedureAddress Note - This routine is a thin wrapper around GetProcAddress; this means *any* call to GetProcAddress acquires the loader lock. LdrpCodeAuthzCheckDllAllowed LdrpGetShimEngineInterface LdrpSnapThunk _LdrQueryModuleInfoLocalLoaderLock@0 (1 reference to LdrpLoaderLock) Description - not referenced internally by NTDLL or externally by system DLLs. Acquires the loader lock via RtlEnterCriticalSection if the process is not in loader initialization. RtlCheckForOrphanedCriticalSections (425) (1 reference to LdrpLoaderLock) Description - Tests if the current critical section in the critical section list-walk is the loader lock. External references to RtlCheckForOrphanedCriticalSections OLE32.DLL CDllHost::STAWorkerLoop CRpcThread::WorkerLoop VERIFIER.DLL RtlpNotOwnerCriticalSection (865) (1 reference to LdrpLoaderLock) Description - not referenced internally by NTDLL or externally by system DLLs. Tests if the 1st input parameter is the loader lock. RtlpWaitForCriticalSection (873) (2 references to LdrpLoaderLock) Description - tests if the 1st parameter is the loader lock but does not acquire it. Internal NTDLL references to RtlpWaitForCriticalSection RtlEnterCriticalSection External references to RtlpWaitForCriticalSection VERIFIER.DLL _RtlpCheckForCriticalSectionsInMemoryRange@12 (1 reference to LdrpLoaderLock) Description - Tests if the current critical section in the critical section list-walk is the loader lock. Internal NTDLL references to RtlpCheckForCriticalSectionsInMemoryRange LdrUnloadDll RtlpDebugPageHeapDestroy RtlpDebugPageHeapFree@ RtlpDphNormalHeapFree