-This flag can be used to make [DLL planting attacks](/windows/win32/dlls/dynamic-link-library-security) more difficult. For example, consider an app that imports a dependent DLL. An attacker could plant a DLL with the same name earlier in the import resolution search path, such as the application directory. If you specify the link option `/DEPENDENTLOADFLAG:0x800` (the value of the flag `LOAD_LIBRARY_SEARCH_SYSTEM32`), then even if safe DLL search mode is disabled on the user's computer, the module search path is limited to the %windows%\system32 directory. Protected directories are more difficult - but not impossible - for an attacker to change.
0 commit comments