From 391085b614af81bbbb78468d85fc8c7b6d2357a0 Mon Sep 17 00:00:00 2001 From: Hypervisor Date: Thu, 17 Jun 2021 17:49:52 -0600 Subject: [PATCH] Update README.md --- README.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/README.md b/README.md index e6a5133..b4829db 100644 --- a/README.md +++ b/README.md @@ -12,6 +12,7 @@ https://www.mdsec.co.uk/2021/06/bypassing-image-load-kernel-callbacks/ DARKMODULE DarkModule = DarkLoadLibrary( LOAD_LOCAL_FILE, // control flags L"TestDLL.dll", // local dll path, if loading from disk + NULL, // DLL Buffer to load from if loading from memory 0, // dll size if loading from memory NULL // dll name if loaded from memory ); @@ -26,6 +27,10 @@ DARKMODULE DarkModule = DarkLoadLibrary( This can be any path that `CreateFileW` will open. +### DLL Buffer: + +This argument is only needed when `LOAD_MEMORY` is set. In that case this argument should be the buffer containing the DLL. + #### DLL Size: This argument is only needed when `LOAD_MEMORY` is set. In that case this argument should be the size of the buffer containing the DLL.