title: STATUS_INVALID_IMAGE_HASH (0xc0000428) on valid PE files
body: <p>I tried loading the DLL file "bcryptprimitives.dll" (which in my case, originally sits under "C:\Windows\syswow64\bcryptprimitives.dll") from another location, with this snippet of code:</p>
  
  <pre><code>LoadLibraryW(L"&lt;altered path&gt;\\bcryptprimitives.dll");
  </code></pre>
  
  <p>However, right after executing this line of code I get the following error:</p>
  
  <p><a href="https://i.stack.imgur.com/WqMDo.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/WqMDo.png" alt="enter image description here"></a></p>
  
  <p><em>C:\Program Files (x86)\Notepad++\bcryptprimitives.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support. Error status 0xc0000428.</em></p>
  
  <p>I searched the 0xc0000428 NTSTATUS in the following dictionary: <a href="https://msdn.microsoft.com/en-us/library/cc704588.aspx" rel="nofollow noreferrer">https://msdn.microsoft.com/en-us/library/cc704588.aspx</a>
  and apparently this status means <code>STATUS_INVALID_IMAGE_HASH</code>.</p>
  
  <p>The error at first makes sense, because I changed the "LoaderFlags" field in the image PE header from 0x00000000 to 0x00000001 (which doesn't need to affect anything because this field is deprecated), but even though I changed the field, I fixed the PE checksum.</p>
  
  <p><a href="https://i.stack.imgur.com/BQOTP.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/BQOTP.png" alt="enter image description here"></a></p>
  
  <p>As you can see: <a href="https://i.stack.imgur.com/yHdFd.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/yHdFd.png" alt="enter image description here"></a></p>
  
  <p>However, LoadLibrary still refuses to load the DLL.
  Diving deep into <code>ntdll</code> reveals that the error is returned from kernel:</p>
  
  <p><a href="https://i.stack.imgur.com/X4lVL.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/X4lVL.png" alt="enter image description here"></a></p>
  
  <p>It makes me think that the DLL is somehow signed and the kernel checks whether the DLL was altered.
  So to my point, how can I load this DLL from another location anyway and remove the sign check?</p>