MemoryModulePP
MemoryModulePP, used to load a DLL from memory. MemoryModulePP is compatible with Win32 API and supports exception handling.
MemoryModulePP is developed based on MemoryModule.
In order to support 32-bit dll exception handling, the dll should enable the /SAFESEH linker option, otherwise the exception handler cannot pass the RtlIsValidHandler () check when an exception occurs
Features
- Compatible with Win32 API (GetModuleHandle, GetModuleFileName, GetProcAddress and any Resource API)
- Support for C++ exceptions and SEH
- Optimized MEMORYMODULE structure
- Use reference counting, repeated loading of the same module will update the reference counting, please refer to NtLoadDllMemoryExW
- The above features can be turned off through the dwFlags parameter of NtLoadDllMemoryExW
- Support for TLS(Thread Local Storage)
- DllMain can receive four types of notifications
- Support forward export
Tech
MemoryModulePP uses many open source projects and references to work properly:
- Vergilius Project - Some windows kernel structure reference.
- MemoryModule - Load dll from memory, reference and improve part of this repository's code.
- Blackbone - Windows memory hacking library, Referenced the idea of exception handling.
- Exceptions on Windows x64 - How Windows x64 Exception Handling Works. (Russian)
- Reactos - How Windows loads dll.
Todos
- Looking for a good way to locate the LdrpHandleTlsData function, or implement this function.