MemoryModulePP

MemoryModulePP, used to load a DLL from memory. MemoryModulePP is compatible with Win32 API and supports exception handling.

MemoryModulePP is developed based on MemoryModule.

Features

• Compatible with Win32 API (GetModuleHandle, GetModuleFileName, GetProcAddress and any Resource API)
• Support for C++ exceptions and SEH

  In order to support 32-bit dll exception handling, the dll should enable the /SAFESEH linker option, otherwise the exception handler cannot pass the RtlIsValidHandler() check when an exception occurs

• Support reference counting
• Support Thread Local Storage
  There are 2 ways to handle tls: MmpTls and LdrpTls, which you can control via MMPP_USE_TLS macro in stdafx.h.
  
  

  	MmpTls(MmpTls.cpp)	LdrpTls(MmpLdrpTls.cpp)
  Description	Implemented by MemoryModulePP	Implemented by NTDLL
  Compatibility	Medium	Low
  Stability	Low	High

• DllMain can receive four types of notifications
• Support forward export
• Support SetUnhandledExceptionFilter()
• Provides limited support for .NET assembly loading

Tech

MemoryModulePP uses many open source projects and references to work properly:

• Vergilius Project - Some windows kernel structure reference.
• MemoryModule - Load dll from memory, reference and improve part of this repository's code.
• Blackbone - Windows memory hacking library, Referenced the idea of exception handling.
• Exceptions on Windows x64 - How Windows x64 Exception Handling Works. (Russian)
• Reactos - How Windows loads dll.

Todos

• Add support for ReflectionLoader
• Improve the stability of MmpTls
• Bug fixes