MemoryModulePP, used to load a DLL from memory. MemoryModulePP is compatible with Win32 API and supports exception handling.
MemoryModulePP is developed based on MemoryModule.
- Compatible with Win32 API (GetModuleHandle, GetModuleFileName, GetProcAddress and any Resource API)
- Support for C++ exceptions and SEH
In order to support 32-bit dll exception handling, the dll should enable the /SAFESEH linker option, otherwise the exception handler cannot pass the
RtlIsValidHandler()check when an exception occurs - Support reference counting
- Support Thread Local Storage
There are 2 ways to handle tls: MmpTls and LdrpTls, which you can control viaMMPP_USE_TLSmacro in stdafx.h.
MmpTls(MmpTls.cpp) LdrpTls(MmpLdrpTls.cpp) Description Implemented by MemoryModulePP Implemented by NTDLL Compatibility Medium Low Stability Low High - DllMain can receive four types of notifications
- Support forward export
- Support
SetUnhandledExceptionFilter() - Provides limited support for .NET assembly loading
MemoryModulePP uses many open source projects and references to work properly:
- Vergilius Project - Some windows kernel structure reference.
- MemoryModule - Load dll from memory, reference and improve part of this repository's code.
- Blackbone - Windows memory hacking library, Referenced the idea of exception handling.
- Exceptions on Windows x64 - How Windows x64 Exception Handling Works. (Russian)
- Reactos - How Windows loads dll.
- Add support for ReflectionLoader
- Improve the stability of MmpTls
- Bug fixes