问题描述
我只是偶然地发现，执行此 GetModuleHandle（ ntdll.dll）无需事先调用 LoadLibrary（ ntdll.dll）。
I've just found out by accident that doing this GetModuleHandle("ntdll.dll") works without a previous call to LoadLibrary("ntdll.dll").
这意味着 ntdll.dll 已加载我的进程。
This means ntdll.dll is already loaded in my process.
可以安全地假设 ntdll.dll 将始终加载到Win32应用程序上，这样
Is it safe to assume that ntdll.dll will always be loaded on Win32 applications, so that a call to LoadLibrary is not necessary?
推荐答案
来自（强调我的）：
换句话说，继续调用LoadLibrary（）并确保您可以安全地使用 ntdll.dll 的句柄-但系统几乎可以肯定是
In other words, continue to call LoadLibrary() and ensure you get your handle to ntdll.dll to be safe -- but the system will almost certainly be bumping a reference count as it should already be loaded.
至于是否真的总是加载？，请参见（简短的回答是， ntdll.dll 是加载程序本身的一部分，并且始终存在）。
As for "is it really always loaded?", see Windows Internals on the Image Loader (the short answer is yes, ntdll.dll is part of the loader itself and is always present).
相关段落为：
这篇关于Win32应用程序是否自动链接到ntdll.dll？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！