为什么注入的任何 DLL 都会导致主机进程崩溃？
在对我的软件的新版本进行 Beta 测试时，一些用户报告运行该应用程序时出现异常。在这两种情况下，都是：“应用程序无法正确启动（0xc0000142）”。我也看到它为 0xc0000005。我发现本地系统也存在此错误，并且在调试器下运行它时发现“datamngr.dll”存在访问冲突并且在堆上分配失败。我很快发现“datamngr.dll”是间谍软件，并且正在像系统的 AppInit 中一样加载。
一旦我清除了 AppInit 注册表项，这个问题就消失了。我通过 Process Monitor 检查了它，每当注入这个 DLL 时，我的应用程序就会崩溃。我认为这只是写得不好的间谍软件，但后来我发现其他 DLL 也在做同样的事情（例如 acaptuser32.dll，这是合法软件）。对我来说奇怪的是我的软件的先前版本没有崩溃。这两个版本之间有很多很多的变化，所以很难说到底是什么。
我从哪里开始呢？一些在线探索显示，Firefox 等应用程序取代了 LoadLibrary，将 DLL 列入黑名单，防止注入。但我想从更基本的问题开始——为什么应用程序现在崩溃了，而以前没有崩溃？
我意识到这是非常模糊的，但这几乎是不可避免的。我希望我做错的项目的属性中有一些明显的东西。我尝试过打开和关闭 ASLR、打开和关闭 DEP...我尝试过延迟加载 user32.dll 并通过 LoadLibrary 手动加载它（将 SetErrorMode 设置为忽略错误），但没有任何效果。我们已经在 Windows XP 和 Windows 7（32 位和 64 位）上看到过这种情况发生。
任何关于从哪里开始的指示将不胜感激。如果有人需要其他详细信息，我将提供尽可能多的信息。
干杯
In beta testing a new release of my software, several users reported exceptions when running the app. In both cases it's: "The application was unable to start correctly (0xc0000142)". I've also seen it as 0xc0000005. I found a local system with this error as well and found when running it under a debugger, "datamngr.dll" had an access violation and failed allocating on the heap. I quickly discovered "datamngr.dll" is spyware and is being loaded as it was in the system's AppInit.
Once I cleared the AppInit reg key, this problem went away. I checked it out via Process Monitor, and any time this DLL was being injected, my application crashed. I thought it was just badly written spyware, but I've since found other DLLs doing the same thing (such as acaptuser32.dll, which is legitimate software). What's odd to me is the previous version of my software does not crash. There's been many, many changes between the two versions so it's hard to say what it is.
Where do I start here? Some online exploring shows apps like Firefox replace LoadLibrary to blacklist DLLs from being injected. But I'd like to start from the more basic -- why is the application now crashing when it didn't before?
I realize this is very vague, but that's pretty much unavoidable. I'm hoping there's something obvious in the properties for the project I'm doing incorrectly. I've tried with ASLR on and off, DEP on and off...I've tried delay-loading user32.dll and manually loading it via LoadLibrary (with SetErrorMode set to ignore errors), and nothing is working for me. We've seen this happen on Windows XP and Windows 7 (32 and 64-bit).
Any pointers on where to start would be greatly appreciated. I'll provide as much information as I can if anyone needs other details.
Cheers
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我确实找到了解决办法。我使用 Process Monitor 来比较带有和不带有 DLL 注入器的版本中 DLL 加载的顺序。让我印象深刻的一件事是我首先包含了加载 .NET（通过 LoadLibrary）的 C++ DLL。因为 CLR 是如此庞大，所以我决定尝试延迟加载该 DLL 和所有 .NET DLL。就这样——我的问题已经消失了。
所以正如雷蒙德·陈（Raymond Chen）所说——秩序是脆弱的。如果其他人遇到这个问题，我建议调整你的 DLL 加载顺序。
I did find a fix. I used Process Monitor to compare the order of DLL loading in versions with and without DLL injectors. One thing that then struck me is the C++ DLL I have which loads .NET (via LoadLibrary) was being included first. Because the CLR is such a large beast, I decided to try delay-loading that DLL and all .NET DLLs. That's all it took - my problem has gone away.
So it's as Raymond Chen said -- the ordering is fragile. If other people encounter this issue, I suggest just tweaking your DLL loading order.