Skip to content

Latest commit

 

History

History
43 lines (30 loc) · 1.97 KB

README.md

File metadata and controls

43 lines (30 loc) · 1.97 KB
Raw

MemoryModulePP

Build Status

MemoryModulePP, used to load a DLL from memory. MemoryModulePP is compatible with Win32 API and supports exception handling.

MemoryModulePP is developed based on MemoryModule.

In order to support 32-bit dll exception handling, the dll should enable the /SAFESEH linker option, otherwise the exception handler cannot pass the RtlIsValidHandler () check when an exception occurs

Features

  • Compatible with Win32 API (GetModuleHandle, GetModuleFileName, GetProcAddress and any Resource API)
  • Support for C++ exceptions and SEH
  • Optimized MEMORYMODULE structure
  • Use reference counting, repeated loading of the same module will update the reference counting, please refer to NtLoadDllMemoryExW
  • The above features can be turned off through the dwFlags parameter of NtLoadDllMemoryExW
  • Support for TLS(Thread Local Storage)
  • DllMain can receive four types of notifications
  • Support forward export

Tech

MemoryModulePP uses many open source projects and references to work properly:

  • Vergilius Project - Some windows kernel structure reference.
  • MemoryModule - Load dll from memory, reference and improve part of this repository's code.
  • Blackbone - Windows memory hacking library, Referenced the idea of exception handling.
  • Exceptions on Windows x64 - How Windows x64 Exception Handling Works. (Russian)
  • Reactos - How Windows loads dll.

Todos

  • Looking for a good way to locate the LdrpHandleTlsData function, or implement this function.