From The Covert Way to find the Reference Count of DLL:
The load count for a DLL is a 16-bit value. If that value, treated as a signed short, is -1 (0xfffff) it indicates the DLL is statically linked, otherwise it's dynamically loaded.
Pergunta
Using windbg, got the list of dlls with load count by !dlls
command. Observed that the load count is 0x0000ffff
for many loaded dlls.
Is that a default value ?
Is that mean anything else ?
0x00262fa8: C:\WINDOWS\system32\ole32.dll
Base 0x774e0000 EntryPoint 0x774fd0b9 Size 0x0013d000
Flags 0x80084006` LoadCount 0x0000ffff TlsIndex 0x00000000
LDRP_STATIC_LINK
LDRP_IMAGE_DLL
LDR**strong text**P_ENTRY_PROCESSED
LDRP_PROCESS_ATTACH_CALLED
Solução
From The Covert Way to find the Reference Count of DLL:
The load count for a DLL is a 16-bit value. If that value, treated as a signed short, is -1 (0xfffff) it indicates the DLL is statically linked, otherwise it's dynamically loaded.