3 ms·
This tells how to stop it from happening. But my problem was that I needed it to happen (e.g. if using msvcrt) and having no way to do so for DLLs “manually” l
by beagle3 7y ago
This tells how to stop it from happening.
But my problem was that I needed it to happen (e.g. if using msvcrt) and having no way to do so for DLLs “manually” loaded from memory.
- metroholografix 7y agoOne way is to use the Windows library loader and simply trick it to load a DLL from memory rather than disk. If you use a method that completely bypasses the OS loader, then you have to do a lot more work to have your DLL behave like a DLL loaded by the OS would.
- beagle3 7y agoHow do you trick the loader to load from memory?
- metroholografix 7y agoThere are many ways but the one I chose is in my presentation that I linked above. Roughly, first you get an idea of the system calls involved when a DLL is loaded. Then you hook the system calls that are responsible for mapping/reading in order to redirect them to a memory buffer. Conceptually, it's straightforward. The devil is in the implementation details as they say.
- beagle3 7y agoI see. Thanks. I was under the impression you needed to have some non-trivial tokens to patch NtDll in a way that kernel32 would use (which would make it unusable as a general technique), but it's been ages and I'm probably misremembering.