+This flag can be used to make [DLL planting attacks](/windows/win32/dlls/dynamic-link-library-security) more difficult. For example, consider an app that imports a dependent DLL by name. An attacker could plant a DLL with the same name earlier in the import resolution search path, such as the application directory. If you specify the link option `/DEPENDENTLOADFLAG:0x800` (the value of the flag `LOAD_LIBRARY_SEARCH_SYSTEM32`), then the module search path is limited to the %windows%\system32 directory. Protected directories are more difficult - but not impossible - for an attacker to change. For more information, see [Dynamic-Link Library Security](/windows/win32/dlls/dynamic-link-library-security).
0 commit comments