LoadLibrary Reference Counting

Question

From MSDN:

The system maintains a per-process reference count on all loaded modules. Calling LoadLibrary increments the reference count.

Where is that reference count stored?

Answer 1

The actual windows loader is found in NTDLL.dll's LdrLoadDll function. This function is undocumented, and its internal functionality is subject to change in future versions of windows; only those with access to the windows source code could state for certain what happens behind the scenes.

However, wine's source is available, and you can see where it increments the reference count; it's stored in the LoadCount member of the LDR_MODULE heap structure. Since this doesn't seem to be a wine-internal structure, it's likely that this structure is based off the real, reverse-engineered windows structures, and thus windows probably stores it in the same way. However, since this is undocumented, it is subject to change in any future version of windows, or even with minor windows patches.

Answer 2

This is just a guess, but it's probably a global variable inside kernel32.dll (that's the DLL that imlements LoadLibrary).