[MS] The case of the DLL that was not present in memory despite not being formally unloaded, part 2 - devamazonaws.blogspot.com
Last time, we looked at crashes caused by a DLL being removed from memory behind everybody's back , causing crashes when somebody tried to call into that no-longer-there DLL that everybody thought was still there. A colleague of mine who was looking at other crashes coming from this process found that most of those other crashes were also of the form "a data structure was corrupted because somebody wrote the single byte 01 into it." That piece of information made everything fall into place for my side of the investigation. We saw earlier that the bottom bit of the HMODULE is set for datafile module handles . Therefore, if one of these stray 01 bytes happens to overwrite the bottom byte of an existing HMODULE handle, that turns it into a (fake) datafile module handle. And then, during process destruction, a component dutifully cleans up the DLLs they loaded by freeing them (say because they were stored in an RAII type like wil:: unique_ hmodule ), the code will pas...