4 ms·
https://docs.microsoft.com/en-us/windows/desktop/api/libloaderapi/nf-libloaderapi-disablethreadlibrarycalls https://docs.microsoft.com/en-us/windows/desktop/api
by metroholografix 7y ago
https://docs.microsoft.com/en-us/windows/desktop/api/libloaderapi/nf-libloaderapi-disablethreadlibrarycalls https://docs.microsoft.com/en-us/windows/desktop/api/libload...
- beagle3 7y agoThis tells how to stop it from happening. But my problem was that I needed it to happen (e.g. if using msvcrt) and having no way to do so for DLLs “manually” loaded from memory.
- metroholografix 7y agoOne way is to use the Windows library loader and simply trick it to load a DLL from memory rather than disk. If you use a method that completely bypasses the OS loader, then you have to do a lot more work to have your DLL behave like a DLL loaded by the OS would.
- beagle3 7y agoHow do you trick the loader to load from memory?
- metroholografix 7y agoThere are many ways but the one I chose is in my presentation that I linked above. Roughly, first you get an idea of the system calls involved when a DLL is loaded. Then you hook the system calls that are responsible for mapping/reading in order to redirect them to a memory buffer. Conceptually, it's straightforward. The devil is in the implementation details as they say.
- beagle3 7y agoI see. Thanks. I was under the impression you needed to have some non-trivial tokens to patch NtDll in a way that kernel32 would use (which would make it unusable as a general technique), but it's been ages and I'm probably misremembering.