LoadLibraryEx - LDR_IS_DATAFILE, LDR_IS_IMAGEMAPPING - another mistake in MSDN?

Tags: #<Tag:0x00007f224ce7a890> #<Tag:0x00007f224ce7a750>

First mistake Win API bitmasks two with same value - is this a MS doc’s mistake? - questions - ClarionHub

Second mistake?
LoadLibraryExA function (libloaderapi.h) - Win32 apps | Microsoft Docs

`[in] dwFlags`

The action to be taken when loading the module. If no flags are specified, the behavior of this function is identical to that of the [LoadLibrary](https://docs.microsoft.com/en-us/windows/desktop/api/libloaderapi/nf-libloaderapi-loadlibrarya) function. This parameter can be one of the following values.

Scroll down the webpage and there are these C++ macros which can test how the module is loaded.

#define LDR_IS_DATAFILE(handle)      (((ULONG_PTR)(handle)) &  (ULONG_PTR)1)
#define LDR_IS_IMAGEMAPPING(handle)  (((ULONG_PTR)(handle)) & (ULONG_PTR)2)
#define LDR_IS_RESOURCE(handle)      (LDR_IS_IMAGEMAPPING(handle) || LDR_IS_DATAFILE(handle))
Macro Description
LDR_IS_DATAFILE(handle) If this macro returns TRUE, the module was loaded as a data file (LOAD_LIBRARY_AS_DATAFILE or LOAD_LIBRARY_AS_DATAFILE_EXCLUSIVE).
LDR_IS_IMAGEMAPPING(handle) If this macro returns TRUE, the module was loaded as an image file (LOAD_LIBRARY_AS_IMAGE_RESOURCE).
LDR_IS_RESOURCE(handle) If this macro returns TRUE, the module was loaded as either a data file or an image file.

What I’m actually seeing is
no flags = LDR_IS_DATAFILE

Does anyone else see this? It seems contrary what the webpage is saying and I’m wondering if this is another mistake in the docs or something up with my system?



I should add, its not an unloading thing because I get different results when I switch over the different flags and LoadLibrary works like LOAD_LIBRARY_AS_DATAFILE and NOT with no flags as the docs state either.

The reason for all this scrutiny is because someone has found a way to circumvent the built in windows 10 ransomware protection on my offline dev machine (unless its someone in the building doing it when I’m away from it) and although not being ransomewared, whoever has been restoring backups of incomplete work over completed work, ergo, stuff is not working or has bugs in it.