#C++ LoadLibraryA Memory

189 messages ยท Page 1 of 1 (latest)

candid locustBOT
#

@delicate hare has reached level 5. GG!

north mountain
#

Whats the error

hexed basin
#

Because loading a DLL from memory is not supported by windows

#

It's a bunch of dirty hacks

delicate hare
hexed basin
#

still what?

delicate hare
#

i need to get it working

hexed basin
#

why do you need this anyways?

delicate hare
#

this is the thing i use

#

so i dont have to have it on disk

hexed basin
#

why?

delicate hare
#

so i can have 1 .exe instead of a thousand dlls

hexed basin
#

why?

delicate hare
#

cause its cleaner

#

what

hexed basin
#

not really

#

why does it matter?

delicate hare
#

is it better for my other apps to download this .exe

#

or

#

i have to make it download 1 .exe and then dlls

#

its simpler

hexed basin
#

download a .zip then extract it

delicate hare
#

in c++

hexed basin
#

why is your app downloading executables anyways?

delicate hare
#

how else will it open stuff

hexed basin
#

If you really want just one .exe then the solution is to statically link the dependencies

hexed basin
delicate hare
#

why does anything have to open anything

#

bro what are these questions

hexed basin
#

discord doesn't randomly download .exe and execute them Thonk

delicate hare
#

yes it does

#

the updater downloads a .exe

hexed basin
delicate hare
#

i just need to load the dll in memory

hexed basin
#

you really don't

delicate hare
#

are there things like relocations i have to worry about

hexed basin
#

with this method anything can break at any moment

delicate hare
#

thats kinda gay

hexed basin
#

but yes, the method you are trying to use is not reliable

#

I have suggested a method that is more correct and reliable tho

delicate hare
#

what does drogatory mean

#

do u mean derogatory

hexed basin
#

that was a typo sorry

hexed basin
#

simply link the dependencies statically

delicate hare
delicate hare
hexed basin
#

then the dlls will be baked into the executable

hexed basin
delicate hare
#

yeah but

#

im trying to link the dll to another dll

hexed basin
#

you can do that sure

delicate hare
#

i need the first dll to not have any crt dependencies tho

#

and the first dll is pure C

hexed basin
#

why?

delicate hare
#

so it doesnt mess up the first .exe

hexed basin
#

seems like you are overcomplicating things

delicate hare
#

i mean this is just how it needs to be

hexed basin
#

if you explain why maybe we can probide further guidance

delicate hare
#

if the first dll has any crt dependencies or dynamic libraries or something then it crashes the first .exe

hexed basin
#

get rid of all dlls

delicate hare
#

so i made a first dll that has no crt dependencies that handles the loading of the second dll that has crt dependencies

hexed basin
#

statically link everything

delicate hare
#

is there no other way?

hexed basin
#

if you want no file beside your program you either do that or you put the source code of the dependencies directly into your program

north mountain
#

Ill see if i can fix it

#

Staff here doesnt like loadlib or anything memory related

delicate hare
#

i asked deepseek it said i need to

1. Rebuild the DLL with Relocations
In Visual Studio:

Go to Project Properties โ†’ Linker โ†’ Advanced โ†’ Randomized Base Address โ†’ Set to Yes (/DYNAMICBASE).

Remove /FIXED from linker flags (if present).

This adds relocation data, allowing the DLL to load at any address.
delicate hare
north mountain
#

i believe your dllData is wrong

#

im not going to lie, ive never loaded dlls from memory but yea

north mountain
#

im a lil busy today, but if you really cant figure out how to fix this out ill ask my pro friend

#

to help

delicate hare
#

i have been trying to figure it out all day for like 3 days already

#

but im trying the dllloader rn

delicate hare
#

dllloader worked with loadfromfile but not loadfrommemory

#

like it ran the dll for a little and then the dll stopped

#

but loadfromfile worked perfectly

#

i looked at the sampeldll code

#

do i need to also use MODULE instead of SHARED?

hexed basin
#

you have the source code?

delicate hare
#

of what

delicate hare
hexed basin
#

the dependencies?

delicate hare
#

openssl

#

and stuff

delicate hare
#

but i dont get

#

how loadlibrarya works

#

and this doesnt

#

i mean yeah memory hacky wacky

#

but

#

the memorymodule should handle all the things that loadlibrarya

#

does

hexed basin
#

it doesn't

delicate hare
#

my dll has openssl so this should help

#

but i have NO idea how that dude fixed it

#

cause the way he worded it i cant understand anything

#

oh is he loading the openssl.dll instead of using openssl.lib

#

well that doesnt fix my problem cause id have to then load motha flipin openssl from memory and the same thing will happen

#

i think i might have found a fix

#

in the dllloader

#

what if i memoryloadlibrary of openssl.dll before i load the main.dll

delicate hare
#

tried to use procmon to see what more dlls it needs but it didnt show anything so i need to somehow

#

find those

delicate hare
#

i loaded all the possible dlls that there are to load

candid locustBOT
#

@delicate hare has reached level 6. GG!

delicate hare
#

for openssl the libcrypto libssl zlib

#

it like works but it doesnt start

#

it just sends out the startup console.log and then it just starts waiting for input but it doesnt start the thing that is the main purpose of it

#

how could i find out whats wrong

#

for example if openssl gets a error or something

grim hull
#

why do you have to make this so complicated

#

it's so obvious you're trying to make something malicious and if this is the case loading libraries dynamically is heavily detected and will just get you 70/70 on virus total

delicate hare
#

i just need to get it working

#

how do u even interpret loading a file in memory malicious

#

id get if it was loading a executable in memory

hexed basin
delicate hare
#

well if it were the same then why doesnt it work

#

would i really go thru all of this effort as a "skid malware writer p100"

hexed basin
#

yes

grim hull
#

yes

candid locustBOT
#

@grim hull has reached level 3. GG!

delicate hare
#

lol

#

if loading a dll from memory is only for malicious use then i dont seem to understand why so many people have starred the repo on github

hexed basin
#

well you still haven't given a compeling reasin why you are trying to do something that is not supported by Windows when there are other supported ways

north mountain
hexed basin
# delicate hare .

like I said, you could package it in a compressed file, you can link statically
you can even package everything into a single executable that then extracts itself somewhere before running the real stuff (or use an installer)
you can write the dll to file and then load it from there

#

there are so many valid and reliable ways to do it

delicate hare
#

yeah but i wanna load it from memory without having to exclusively drop a file

hexed basin
#

I gave examples of how to do that too

grim hull
delicate hare
#

it is multithreaded

#

but how do i "statically link it" exactly

#

i need to make the first.dll load the second.dll

#

first.dll loading the second.dll using loadlibrary works

#

so

#

how do i statically link second.dll to first.dll

grim hull
#

are you breaking your project into multiple dlls

delicate hare
#

no

grim hull
#

I don't understand. why does first.dll need to load second.dll

#

i think you need to refactor your approach and go back to the drawing board

delicate hare
#

it doesnt matter

#

it just needs to be done

#

and im trying to look at a way to do it

#

not to be told to do it another way

grim hull
#

well we'll see how far it gets you then

hexed basin
#

the right way to run your executable without having the dlls on the side is to link them statically

delicate hare
#

i think i found a project that can do it

#

its a project that hooks the file getting part of the loadlibrary

#

and overwrites it with the data

#

thats smart

grim hull
#

See if this interests you

#

pretty much a recreation of win32's loadlibary

#

obviously you'd need to implement it with whatever you're using if you do decide to test with this

delicate hare
#

bro to be honest with u

#

i dont understand shit whats going on in that code

grim hull
#

you would use GetLoadedModule with your dll name to load it

delicate hare
#

i managed to get it working tho

#

now

#

using

grim hull
#

๐Ÿ‘

delicate hare
delicate hare
#

but now

#

i need to convert it to C