Thread: Win32 API - Dynamic Link Library Loading - behind the scenes

Hi everybody !

My problem is that I want to load a library (DLL)
that resides in memory. I am not a newbie, nor
do I need any help with C/C++. Actually this
questions is targeted at those amongst you
who have got some deeper knowledge of the
Win32 Sub-system. Concerning dynamic loading
of libraries you would either statically link a DLL's
library to the final executable or load the DLL
at runtime via LoadLibrary() and then get the
the address/handle via GetProcAddress of the
relevant function.
What I want to do is to load a DLL without using
the mentioned functions. Win32 is doing quite a lot
_behind the scenes_ - For Example RVA to Offset
calculation and such stuff is done via APIs
that are rather undocumented. IAT patching is also
done in the background - without any user interaction
respectively user code being involved in that process.
Although I do know a couple of functions that are
executed I don't know everything what's going on
behind LoadLibrary() and GetProcAddress().
In particular I need those functions that are involved
with memory mapped files - DLLs are mapped when
being executed. So that I would be able to
load an image of a DLL that's beein loaded into the memory
without the usual functions.

Thanks for all comments/ideas (if any)


regards

Mike

Originally posted by Fordy
I dont know exatly why you dont wish to load the library using the standard methods........

Well, an example:
I've got an image of a DLL already loaded in memory.
Let's say the image is a custom resource which
has been loaded and mapped into memory.
Now, actually LOADING that DLL would require
to DUMP that DLL to the harddisk - as a file so
that in can be loaded by the corresponding standard
functions which require files instead of memory
areas.

Originally posted by Fordy
your "_behind the scenes_" concerns about the standard API methods have never bothered me....

Most API-calls basically call sub-system functions -
especially under Win NT and its derivates.

Originally posted by Fordy
but then I dont know exactly what you are trying to do.......

In short I described it ... though, the actual
application is siginificantly more complicated
and would take too long to explain.

Originally posted by Fordy
I know how the system uses Memory mapping to load dlls....

Do you know details of what's happening INSIDE -
behind LoadLibrary/GetProcAddress ?
Memory Mapping itself is not a problem...
But processing the subtleties of the PE-File format
is what I need to do at runtime in memory -
without any files being present or accessed.

Originally posted by Fordy
but I dont know if it would be easy (or even possible) to access this map in another process.....

yes, you CAN access a map in another process -
though this is actually not what I need to do.

Originally posted by Fordy
assuming this is what you are proposing....also I dont know if that code would be usable by you even if you had access to it

shouldn't be a problem - it's a little bit tricky.

Originally posted by Fordy
Like I said, I dont know what you are trying to do so I dont know what more I could suggest on this.............

thanks, anyway !