MemoryModule icon indicating copy to clipboard operation
MemoryModule copied to clipboard

[WIP] Provide ANSI and UNICODE versions of all resource functions.

Open fancycode opened this issue 9 years ago • 1 comments

Currently work in progress...

fancycode avatar Sep 21 '16 00:09 fancycode

Your code is not required. It is even exactly the OPPOSITE: You can delete all the resource functions:

MemoryFindResource( )
_MemorySearchResourceEntry( )
MemoryFindResourceEx( )
MemorySizeofResource( )
MemoryLoadResource( )
MemoryLoadString( )
MemoryLoadStringEx( )

NONE of these functions is required. Let Windows do that job.

You only must do a tiny change in the struct MEMORYMODULE: Change the order of the first 2 entries:

typedef struct 
{
    BYTE* codeBase;
    PIMAGE_NT_HEADERS headers;
    HCUSTOMMODULE *modules;
    int numModules;
   .....
} MEMORYMODULE, *PMEMORYMODULE;

so codeBase becomes the first entry.

Then you can test that in DllLoader.cpp with:

void LoadFromMemory(void)
{
    .........
    HMEMORYMODULE handle = MemoryLoadLibrary(data, size);

    // Load MEMORYMODULE->codeBase into HINSTANCE
    HINSTANCE h_Inst = ((HINSTANCE*)handle)[0];

    HRSRC resourceInfo = FindResource(h_Inst, MAKEINTRESOURCE(VS_VERSION_INFO), RT_VERSION);
    _tprintf(_T("MemoryFindResource returned 0x%p\n"), resourceInfo);

    DWORD  resourceSize = SizeofResource(h_Inst, resourceInfo);
    LPVOID resourceData = LoadResource  (h_Inst, resourceInfo);
    _tprintf(_T("Memory resource data: %ld bytes at 0x%p\n"), resourceSize, resourceData);

    char s8_Buf[100];
    LoadStringA(h_Inst, 1, s8_Buf, 100);
    printf("MemoryLoadStringA: %s\n", s8_Buf);         // print "Hello"

    WCHAR u16_Buf[100];
    LoadStringW(h_Inst, 20, u16_Buf, 100);
    wprintf(L"MemoryLoadStringW: %s\n", u16_Buf);      // print "World!"

    MemoryFreeLibrary(handle);
}

As you see I only use the Windows resource functions for a DLL which has been loaded with MemoryLoadLibrary(). I don't know why Joachim has made it so complicated.

You can even use LoadImage() and LoadCursor() etc... I tested that on Windows XP up to Windows 10.

Elmue avatar Jun 20 '20 17:06 Elmue