14

As the question says, I want to load a DLL from a location in memory instead of a file, similarly to LoadLibrary(Ex). I'm no expert in WinAPI, so googled a little and found this article together with MemoryModule library that pretty much meets my needs.

On the other hand the info there is quite old and the library hasn't been updated for a while too. So I wanted to know if there are different, newer and better ways to do it. Also if somebody has used the library mentioned in the article, could they provide insight on what I might be facing when using it?

Just for the curious ones, I'm exploring the concept of encrypting some plug-ins for applications without storing the decrypted version on disk.

2
  • 4
    Here's ready to use source code for loading DLL from memory: github.com/fancycode/MemoryModule Aug 9, 2016 at 12:40
  • It is no problem that the code is old. It still works on Windows 10. The only thing which is missing in MemoryModule is the Activation Context. But if you need that it is easy to add.
    – Elmue
    Jul 1, 2020 at 13:49

3 Answers 3

5

Implementing your own DLL loader can get really hairy really fast. Reading this article it's easy to miss what kind of crazy edge cases you can get yourself into. I strongly recommend against it.
Just for a taste - consider you can't use any conventional debugging tools for the code in the DLL you're loading since the code you're executing is not listed in the region of any DLL known by the OS.
Another serious issue is dealing with DEP in windows.

2
  • Thanks for the insight. I agree that reimplementing the DLL loader isn't a good idea, so I'm looking for other ways to do it - maybe it's possible to cheat LoadLibrary or filesystem somehow. Mar 12, 2009 at 12:44
  • It is not for beginners. But it is possible. github.com/fancycode/MemoryModule does it well. The only thing which is missing is creating the Activation Context (done with a few lines of code). DEP is not an issue. If the DLL uses a IMAGE_DIRECTORY_ENTRY_EXCEPTION (rarely used) this is already implemented for x64 DLL Injection. For 32 bit this is hairy. But there is a hack: github.com/strivexjun/MemoryModulePP
    – Elmue
    Jul 1, 2020 at 20:27
3

Well, you can create a RAM Drive according to these instructions, then copy the DLL you can in memory to a file there and the use LoadLibrary().
Of course this is not very practical if you plan to deploy this as some kind of product because people are going to notice a driver being installed, a reboot after the installation and a new drive letter under My Computer. Also, this does nothing to actually hide the DLL since its just sitting there in the RAM Drive for everybody to watch.

Another thing I'm interested about is Why you actually want to do this? Perhaps your end result can be achieved by some other means other than Loading the DLL from memory. For instance when using a binary packer such as UPX, the DLL that you have on disk is different from the one that is eventually executed. Immediately after the DLL is loaded normally with LoadLibrary, The unpacker kicks in and rewrites the memory which the DLL is loaded to with the uncompressed binary (the DLL header makes sure that there is enough space allocated)

2
  • Yes, I could mimic behavior of UPX and use my unpacker / decryptor as an entry point, which could negotiate the key with the main app then. I'll mark this answer as accepted, thanks for numerous ideas! Mar 14, 2009 at 11:16
  • Both of your "solutions" do not help to protect against reverse engineering. UPX can easily be unpacked. You could protect your DLL with WinLicense or VMProtect which generates a virtual machine where your sensible code runs. This is very difficult to crack. The huge problem is that most antivirus software is not able anymore to analyze what is going on in your DLL and alerts a virus warning. Especially Microsoft's Windows Defender (the worst antivirus) gives lots and lots of false alarms and makes loading the DLL extremely slow.
    – Elmue
    Jul 1, 2020 at 13:48
0

Similar question was raised in here:

Load native C++ .dll from RAM in debugger friendly manner

One of the answers proposes dllloader sample application shown in github:

https://github.com/tapika/dllloader

It supports .dll debugging out of box.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.