2021-10-25 17:15:15 +08:00
2021-06-02 22:45:25 +08:00
2021-10-25 17:15:15 +08:00
2021-10-25 17:15:15 +08:00
2020-12-13 08:46:38 +08:00
2020-02-22 17:46:04 +08:00
2020-02-26 17:26:24 +08:00

MemoryModulePP

Build Status

MemoryModulePP, used to load a DLL from memory. MemoryModulePP is compatible with Win32 API and supports exception handling.

MemoryModulePP is developed based on MemoryModule.

In order to support 32-bit dll exception handling, the dll should enable the /SAFESEH linker option, otherwise the exception handler cannot pass the RtlIsValidHandler () check when an exception occurs

Features

  • Compatible with Win32 API (GetModuleHandle, GetModuleFileName, GetProcAddress and any Resource API)
  • Support for C++ exceptions and SEH
  • Optimized MEMORYMODULE structure
  • Use reference counting, repeated loading of the same module will update the reference counting, please refer to NtLoadDllMemoryExW
  • The above features can be turned off through the dwFlags parameter of NtLoadDllMemoryExW
  • Support for TLS(Thread Local Storage)
  • DllMain can receive four types of notifications
  • Support forward export

Tech

MemoryModulePP uses many open source projects and references to work properly:

  • Vergilius Project - Some windows kernel structure reference.
  • MemoryModule - Load dll from memory, reference and improve part of this repository's code.
  • Blackbone - Windows memory hacking library, Referenced the idea of exception handling.
  • Exceptions on Windows x64 - How Windows x64 Exception Handling Works. (Russian)
  • Reactos - How Windows loads dll.

Todos

  • Looking for a good way to locate the LdrpHandleTlsData function, or implement this function.

S
Description
Automated archival mirror of github.com/bb107/MemoryModulePP
Readme MIT 1,018 KiB
Languages
C++ 69.8%
C 30.2%