fancycode/memorymodule

Windows binaries (.exe, .dll, .sys) use the PE format. To load a DLL from memory, you must understand its structure, which is defined in winnt.h. The format consists of:

1. DOS Header/Stub: For backwards compatibility.
2. PE Header: Contains IMAGE_NT_HEADERS, which includes:
   • IMAGE_FILE_HEADER: Describes the physical format (e.g., NumberOfSections, Characteristics).
   • IMAGE_OPTIONAL_HEADER: Describes the logical format (e.g., ImageBase, SizeOfImage, AddressOfEntryPoint, and the DataDirectory).
3. Section Headers: A list of IMAGE_SECTION_HEADER structures describing the contents (code, data, etc.) and their locations.
4. Sections: The actual data/code blocks.

The DataDirectory within the OptionalHeader is critical for finding imports (Index 1), exports (Index 0), and the base relocation table (Index 5).

To properly free a custom loaded library, you must follow these steps:

1. Call the DLL entry point to notify the library that it is being detached (using DLL_PROCESS_DETACH).
2. Free any external libraries that were used to resolve imports.
3. Free the allocated memory used by the module.

To load a DLL from memory, you must reserve a memory block using VirtualAlloc. The size of the block should be determined by PEHeader->OptionalHeader->SizeOfImage. It is best practice to attempt to reserve the memory at the address specified by ImageBase.

memory = VirtualAlloc((LPVOID)(PEHeader->OptionalHeader.ImageBase),
    PEHeader->OptionalHeader.SizeOfImage,
    MEM_RESERVE,
    PAGE_READWRITE);

If the reserved memory address differs from the ImageBase requested, you must perform Base relocation later.

The DLL entry point function signature used for notifying the library of attachment or detachment is:

typedef BOOL (WINAPI *DllEntryProc)(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved);

The primary handle type used by the MemoryModule API is HMEMORYMODULE.

typedef void *HMEMORYMODULE;

The DataDirectory contains 16 entries defining the logical components of the library. Key indices for manual loading include:

To provide access to exported functions, the exports entry (0) is required. To load the DLL, the imports (1) and base relocation table (5) are necessary.

The IMAGE_NT_HEADERS32 structure is the core of the PE header, containing the file header and the optional header.

typedef struct _IMAGE_NT_HEADERS {
    DWORD Signature;
    IMAGE_FILE_HEADER FileHeader;
    IMAGE_OPTIONAL_HEADER32 OptionalHeader;
} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;