forked from bb107/MemoryModulePP
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathLoadDllMemoryApi.h
More file actions
158 lines (120 loc) · 6.18 KB
/
LoadDllMemoryApi.h
File metadata and controls
158 lines (120 loc) · 6.18 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
#pragma once
#include <Windows.h>
typedef HMODULE HMEMORYMODULE;
typedef PVOID HMEMORYRSRC;
#define MemoryModuleToModule(_hMemoryModule_) (HMODULE(_hMemoryModule_))
#ifndef NT_SUCCESS
#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)
#endif
//Deprecated API
#ifndef _DEPRECATED
NOT_BUILD_WINDOWS_DEPRECATE
__drv_preferredFunction("LoadLibraryMemory", "Deprecated. Use LoadLibraryMemory.")
HMEMORYMODULE MemoryLoadLibrary(const void*);
NOT_BUILD_WINDOWS_DEPRECATE
__drv_preferredFunction("GetProcAddress", "Deprecated. Use Win32API GetProcAddress.")
FARPROC MemoryGetProcAddress(HMEMORYMODULE, LPCSTR);
NOT_BUILD_WINDOWS_DEPRECATE
__drv_preferredFunction("FreeLibrayMemory", "Deprecated. Use FreeLibrayMemory.")
bool MemoryFreeLibrary(HMEMORYMODULE);
NOT_BUILD_WINDOWS_DEPRECATE
__drv_preferredFunction("FindResource", "Deprecated. Use Win32API FindResource.")
HMEMORYRSRC MemoryFindResource(HMEMORYMODULE, LPCTSTR, LPCTSTR);
NOT_BUILD_WINDOWS_DEPRECATE
__drv_preferredFunction("FindResourceEx", "Deprecated. Use Win32API FindResourceEx.")
HMEMORYRSRC MemoryFindResourceEx(HMEMORYMODULE, LPCTSTR, LPCTSTR, WORD);
NOT_BUILD_WINDOWS_DEPRECATE
__drv_preferredFunction("SizeofResource", "Deprecated. Use Win32API SizeofResource.")
DWORD MemorySizeofResource(HMEMORYMODULE, HMEMORYRSRC);
NOT_BUILD_WINDOWS_DEPRECATE
__drv_preferredFunction("LoadResource", "Deprecated. Use Win32API LoadResource.")
LPVOID MemoryLoadResource(HMEMORYMODULE, HMEMORYRSRC);
NOT_BUILD_WINDOWS_DEPRECATE
__drv_preferredFunction("LoadString*", "Deprecated. Use Win32API LoadStringA or LoadStringW.")
int MemoryLoadString(HMEMORYMODULE, UINT, LPTSTR, int);
NOT_BUILD_WINDOWS_DEPRECATE
__drv_preferredFunction("LoadString*", "Deprecated. Use Win32API LoadStringA or LoadStringW.")
int MemoryLoadStringEx(HMEMORYMODULE, UINT, LPTSTR, int, WORD);
#endif
#define MEMORY_FEATURE_SUPPORT_VERSION 0x00000001
#define MEMORY_FEATURE_MODULE_BASEADDRESS_INDEX 0x00000002 /* Windows8 and greater */
#define MEMORY_FEATURE_LDRP_HEAP 0x00000004
#define MEMORY_FEATURE_LDRP_HASH_TABLE 0x00000008
#define MEMORY_FEATURE_INVERTED_FUNCTION_TABLE 0x00000010
#define MEMORY_FEATURE_LDRP_HANDLE_TLS_DATA 0x00000020
#define MEMORY_FEATURE_ALL 0x0000003f
//Get the implementation of the currently running operating system.
NTSTATUS NTAPI NtQuerySystemMemoryModuleFeatures(OUT PDWORD pFeatures);
//Load dll from the provided buffer.
NTSTATUS NTAPI NtLoadDllMemory(
OUT HMEMORYMODULE* BaseAddress, // Output module base address
IN LPVOID BufferAddress, // Pointer to the dll file data buffer
IN size_t Reserved // Reserved parameter, must be 0
);
/*
NtLoadDllMemoryEx dwFlags
*/
//If this flag is specified, all subsequent flags will be ignored.
//Also, will be incompatible with Win32 API.
#define LOAD_FLAGS_NOT_MAP_DLL 0x10000000
//If this flag is specified, this routine will not fail even if the call to LdrpTlsData fails.
#define LOAD_FLAGS_NOT_FAIL_IF_HANDLE_TLS 0x20000000
//If this flag is specified, the input image buffer will not be checked before loading.
#define LOAD_FLAGS_PASS_IMAGE_CHECK 0x40000000
//If this flag is specified, exception handling will not be supported.
#define LOAD_FLAGS_NOT_ADD_INVERTED_FUNCTION 0x00000001
//If this flag is specified, NtLoadDllMemory and NtUnloadDllMemory will not use reference counting.
//If you try to load the same module, it will fail. When you unload the module,
// it will be unloaded without checking the reference count.
#define LOAD_FLAGS_NOT_USE_REFERENCE_COUNT 0x00000002
//If this flag is specified, DllName and DllFullName cannot be nullptr,
// they can be arbitrary strings without having to be correct file names and paths.
//Otherwise, DllName and DllFullName will use random names if they are nullptr.
//For compatibility with GetModuleHandle, DllName and DllFullName should be guaranteed to always end in ".dll"
#define LOAD_FLAGS_USE_DLL_NAME 0x00000004
//Dont call LdrpHandleTlsData routine if this flag is specified.
#define LOAD_FLAGS_NOT_HANDLE_TLS 0x00000008
NTSTATUS NTAPI NtLoadDllMemoryExW(
OUT HMEMORYMODULE* BaseAddress, // Output module base address
OUT PVOID* LdrEntry OPTIONAL, // Receive a pointer to the LDR node of the module
IN DWORD dwFlags, // Flags
IN LPVOID BufferAddress, // Pointer to the dll file data buffer
IN size_t Reserved, // Reserved parameter, must be 0
IN LPCWSTR DllName OPTIONAL, // Module file name
IN LPCWSTR DllFullName OPTIONAL // Module file full path
);
NTSTATUS NTAPI NtLoadDllMemoryExA(
OUT HMEMORYMODULE* BaseAddress,
OUT PVOID* LdrEntry OPTIONAL,
IN DWORD dwFlags,
IN LPVOID BufferAddress,
IN size_t Reserved,
IN LPCSTR DllName OPTIONAL,
IN LPCSTR DllFullName OPTIONAL
);
//Unload modules previously loaded from memory
NTSTATUS NTAPI NtUnloadDllMemory(IN HMEMORYMODULE BaseAddress);
#ifdef _WIN64
#pragma comment(linker,"/export:NtUnloadDllMemoryAndExitThread")
#pragma comment(linker,"/export:FreeLibraryMemoryAndExitThread=NtUnloadDllMemoryAndExitThread")
#else
#pragma comment(linker,"/export:NtUnloadDllMemoryAndExitThread=_NtUnloadDllMemoryAndExitThread@8")
#pragma comment(linker,"/export:FreeLibraryMemoryAndExitThread=_NtUnloadDllMemoryAndExitThread@8")
#endif
//FreeLibraryMemoryAndExitThread = GetProcAddress(GetModuleHandleW(nullptr), "FreeLibraryMemoryAndExitThread");
//FreeLibraryMemoryAndExitThread(hModule, 0);
extern "C" {
__declspec(noreturn) VOID NTAPI NtUnloadDllMemoryAndExitThread(IN HMEMORYMODULE BaseAddress, IN DWORD dwExitCode);
}
HMEMORYMODULE WINAPI LoadLibraryMemory(PVOID BufferAddress);
HMEMORYMODULE WINAPI LoadLibraryMemoryExA(PVOID BufferAddress, size_t Reserved, LPCSTR DllBaseName, LPCSTR DllFullName, DWORD Flags);
HMEMORYMODULE WINAPI LoadLibraryMemoryExW(PVOID BufferAddress, size_t Reserved, LPCWSTR DllBaseName, LPCWSTR DllFullName, DWORD Flags);
BOOL WINAPI FreeLibraryMemory(HMEMORYMODULE hMemoryModule);
#define FreeLibraryMemoryAndExitThread NtUnloadDllMemoryAndExitThread
#ifdef UNICODE
#define NtLoadDllMemoryEx NtLoadDllMemoryExW
#define LoadLibraryMemoryEx LoadLibraryMemoryExW
#else
#define NtLoadDllMemoryEx NtLoadDllMemoryExA
#define LoadLibraryMemoryEx LoadLibraryMemoryExA
#endif