strivexjun / memorymodulepp Goto Github PK

This library is the best pe loader I've found thanks for your contribution, I was just thinking it would be great if you add .net support, I have not so much information but I know before loading .net dlls with export clr.dll gets initialized, It should be possible to add it to the MMPP, It will be great if you can implement it.

Thanks

remove

Hi, try to map ntdll.dll into memory, but failed with calling Wow64cpu.dll.

4B2F1F10 B8 A7010000 mov eax,0x1A7
4B2F1F15 BA F04F304B mov edx,0x4B304FF0
4B2F1F1A FFD2 call edx
4B2F1F1C C2 1000 retn 0x10

4B304FF0 FF25 28423A4B jmp dword ptr ds:[0x4B3A4228]

4B3A4228 00000000

4B3A4228, its dword should be dest to Wow64Cpu.dll memory "jmp far 0x0033:0x77806009" or some address to it.
But it's empty. And how to fix it ?

found a way to fix it manually.

FindPattern 函数的原理是什么

win10 1909都没问题 win10 1803上面加载了Dll之后进程就退了.

The optional SEH handler local implementation of RtlInsertInvertedFunctionTable() is called after the DLLMain() gets called in LdrMapDllMemory.

If an exception happens in DLLMain() it won't be caught (and thus becomes "unhandled").

It would be better to have the exception handler be installed before DLLMain() and is default behavior for the OS too.

Como cargar ?