MemoryModulePP

MemoryModulePP, used to load a DLL from memory. MemoryModulePP is compatible with Win32 API and supports exception handling.

MemoryModulePP is developed based on MemoryModule.

In order to support 32-bit dll exception handling, the dll should enable the /SAFESEH linker option, otherwise the exception handler cannot pass the RtlIsValidHandler () check when an exception occurs

Features

• Compatible with Win32 API (GetModuleHandle, GetModuleFileName, GetProcAddress and any Resource API)
• Support for C++ exceptions and SEH
• Optimized MEMORYMODULE structure
• Use reference counting, repeated loading of the same module will update the reference counting, please refer to NtLoadDllMemoryExW
• The above features can be turned off through the dwFlags parameter of NtLoadDllMemoryExW
• Support for TLS(Thread Local Storage)
• DllMain can receive four types of notifications
• Support forward export

Tech

MemoryModulePP uses many open source projects and references to work properly:

• Vergilius Project - Some windows kernel structure reference.
• MemoryModule - Load dll from memory, reference and improve part of this repository's code.
• Blackbone - Windows memory hacking library, Referenced the idea of exception handling.
• Exceptions on Windows x64 - How Windows x64 Exception Handling Works. (Russian)
• Reactos - How Windows loads dll.

Todos

• Looking for a good way to locate the LdrpHandleTlsData function, or implement this function.