LoadLibrary from within memory?

[MyndFyre]

Is it possible to have a memory representation (a byte stream, for instance) of a DLL and LoadLibrary()-or-equivalent it?  I've found one very involved thing that I don't want to use that involved reading the PE headers and stuff like that.  Not really what I was hoping for.

What it really boils down to is that I just don't want to write the temporary file.  :-|  I want to include a DLL as a resource in my application's binary.

[Skywing]

You would have to do most of the hard work yourself with setting up the in memory layout.  One option might be to hook NtCreateFile/NtCreateSection/NtMapViewOfSection in usermode and let the NTDLL loader manage the import snapping and all of that, with you instead returning a pointer to your own DLL in memory instead of going through the usual image section mapping process.

Note that this approach still requires you to setup the in-memory layout and protections correctly, but it does free you from doing your own import resolution and making the dll accessible to anything using the conventional dll resolution APIs (e.g. GetModuleHandle).

[Yoni]

In other words... Disgusting.

[MyndFyre]

In other words... Disgusting.

Hahaha yes, still more work than I wanted to do.  Thanks though

[Yoni]

You can find a usable temp filename using GetTempFileName (kernel32).

[MyndFyre]

You can find a usable temp filename using GetTempFileName (kernel32).

Yeah, there's a C# API for that too, but I'm not sure I want to do that yet.   

[Joe[x86]]

I'm probably overlooking something but how does WarCraft III apply IX86BlueDrake.dll? I don't think it gets written to a file before it's loaded, just brought straight out of the MPQ.

[UserLoser]

x86] link=topic=15579.msg157728#msg157728 date=1157867092]
I'm probably overlooking something but how does WarCraft III apply IX86BlueDrake.dll? I don't think it gets written to a file before it's loaded, just brought straight out of the MPQ.

Downloads the ix86BlueDrake.mpq, extracts the file to your harddrive, hExtraWork = LoadLibrary(ix86BlueDrake.dll), ExtraWork = GetProcAddress(hExtraWork, "Extrawork"), ExtraWork(&ExtraWorkData).

[Joe[x86]]

Eh, mmk.