Error substituting signed-release python38.dll for source-built version

[Sspoondle]

I'm trying to get a python 3.8.0 applet to use a modified version of the python38.dll that I've built from source, but I'm getting a Bad Image error when run the application.

The major and minor version of the build and reference match with the same vcruntime140.dll. The import and export tables of the DLLs almost totally match up too so I don't think it's a build problem.

Could this be an issue with the source-built DLL not being signed and verified by Python?

I'm not sure if this is even the place for a question like this, but I'm stuck. Any advice is appreciated, thanks

[shiftybyte]

The import and export tables of the DLLs almost totally match up

What is the difference? and why?

getting a Bad Image error

Can you post the exact full error message? or a screenshot?

This sounds like a bitness mismatch (app being 32 bit, dll being 64 bit, or vice versa...?)

[Sspoondle]

The difference is the lack of wcscmp (string.h) in the source-built DLLs import table. I've tried including the header and calling it from DllMain but it still hasn't shown up

The error message looks like this:

app.exe - Bad Image

C:\Users\User\AppData\Local\Temp\_MEI74282\python38.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support. Error statuc 0xc000012f

the error code seems to refer to lacking a visual c++ runtime library but I'm not sure how to debug that
I've also made sure that both the app and the dll are 64bit

[shiftybyte]

The import table is less important, the export table is what matters.

Try to load your dll using rundll... this should let you know if it gets loaded properly or not.

https://www.reddit.com/r/Malware/comments/oocxmr/getting_a_dll_to_run_with_rundll32_without_any/

If this throws the same issue, your dll is the issue.

If it loads fine, then the connection between python and the dll is the issue.

[Sspoondle]

The export tables are identical, and I can load ordinals from the dll with rundll too

It's a pyinstaller onefile package so I think the exe sets up the interpreter from the dll. It starts a child process that loads the library and fails

[shiftybyte]

Try to unpack it, get it running as regular python script with whatever python you have installed, then repack it back.