Hmm... I'm really not sure about these things, but, the "initialization routines" in linked dlls could be run before EiP. And could contain code to trick you in ways... ?

Am I just talking completenonsense? I actualyy don't know squat about it, but I guess I read something somewhere or other... ?

/Manko