Windows

LdrLibraryEx – A Lightweight x64 Library For Loading DLLs Into Memory

A small x64 library to load dll’s into memory. n the world of software development, efficient DLL loading is a crucial aspect of optimizing performance and functionality.

Enter “LdrLibraryEx,” a powerful x64 library designed to streamline the process of loading DLLs into memory.

This lightweight and versatile tool offers developers a range of features, from low dependencies and memory-based loading to advanced functionality, making it an invaluable asset for enhancing Windows application performance.

Join us as we explore the capabilities and benefits of LdrLibraryEx in this comprehensive guide.

Features

  • low dependencies & function use (only ntdll.dll used)
  • position independent code
  • lightweight and minimal
  • easy to use
  • load modules from memory
  • load modules from disk
  • api sets support
  • bypass image load callbacks (using private memory)
  • support for images with delayed import, tls, seh, etc.

Documentation

Library Flags

Flags can be combined

LIBRARYEX_NONE: Map module from disk into memory and execute entrypoint.

LIBRARYEX_BYPASS_LOAD_CALLBACK: Map module from disk into private memory (unbacked) which bypasses image load callbacks (PsSetLoadImageNotifyRoutine)

LIBRARYEX_NO_ENTRY: Do not execute the entrypoint of the module.

LIBRARYEX_BUFFER: Map the module from memory instead from disk.

Function: LdrLibrary

Easy to use function to load a library into memory. The first param, based on what flags has been specified, can be either a wide string module name to load or memory address where the PE is located at.

/*!
 * @brief
 *  load library into memory
 *
 * @param Buffer
 *  buffer context to load library
 *  either a wide string or a buffer pointer 
 *  the to PE file to map (LIBRARYEX_BUFFER)
 *
 * @param Library
 *  loaded library pointer
 *
 * @param Flags
 *  flags
 *
 * @return
 *  status of function
 */NTSTATUS LdrLibrary(
    _In_  PVOID  Buffer,
    _Out_ PVOID* Library,
    _In_  ULONG  Flags
);

This example shows how to load a module from disk (from the System32 path):

PVOID Module = { 0 };
ULONG Flags  = { 0 };

//
// mapping flags to be used by the library
//
Flags = LIBRARYEX_NONE; 

//
// map file into memory
//
if ( ! NT_SUCCESS( Status = LdrLibrary( L"advapi32.dll", &Module, Flags ) ) ) {
    printf( "[-] LdrLibraryEx Failed: %p\n", Status );
    return; 
}

printf( "[*] Module @ %p\n", Module );

This examples shows how to load a module from a memory buffer:

PVOID Module = { 0 };
ULONG Flags  = { 0 };

//
// mapping flags to be used by the library
//
Flags = LIBRARYEX_NONE  | 
        LIBRARYEX_BUFFER; 

//
// read file on disk into memory
//
if ( ! ( Image = ReadFileBuffer( L"C:\\Windows\\System32\\advapi32.dll", NULL ) ) ) {
    puts( "[-] ReadFileBuffer Failed" );
    return;
}

//
// map file into memory
//
if ( ! NT_SUCCESS( Status = LdrLibrary( Image, &Module, Flags ) ) ) {
    printf( "[-] LdrLibraryEx Failed: %p\n", Status );
    return;
}

printf( "[*] Module @ %p\n", Module );

It is also possible to load modules based on their api set (win10+ support only):

//
// map file into memory
//
if ( ! NT_SUCCESS( Status = LdrLibrary( L"api-ms-win-base-util-l1-1-0.dll", &Module, Flags ) ) ) {
    printf( "[-] LdrLibraryEx Failed: %p\n", Status );
    return;
}

printf( "[*] Module @ %p\n",  );

Function: LdrLibraryEx

LdrLibraryEx allows to hook certain functions to modify the behaviour of how a library should be mapped into memory.

//
// mapping flags to be used by the library
// and insert the loaded module into Peb
//
Flags = LIBRARYEX_BYPASS_LOAD_CALLBACK |
        LIBRARYEX_NO_ENTRY;

//
// init LibraryEx context
//
if ( ! NT_SUCCESS( Status = LdrLibraryCtx( &Ctx, Flags ) ) ) {
    printf( "[-] LdrLibraryCtx Failed: %d\n", Status );
    goto END;
}

//
// hook function
//
Ctx.LdrLoadDll = C_PTR( HookLdrLoadDll );

//
// map file into memory
//
if ( ! NT_SUCCESS( Status = LdrLibraryEx( &Ctx, L"cryptsp.dll", &Module, Flags ) ) ) {
    printf( "[-] LdrLibraryEx Failed: %p\n", Status );
    return; 
}

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

WhatsMyName App – Find Anyone Across 640+ Platforms

Overview WhatsMyName is a free, community-driven OSINT tool designed to identify where a username exists…

4 days ago

Analyzing Directory Size Linux Tools Explained

Managing disk usage is a crucial task for Linux users and administrators alike. Understanding which…

4 days ago

Understanding Disk Usage with du Command

Efficient disk space management is vital in Linux, especially for system administrators who manage servers…

4 days ago

How to Check Directory Size in Linux

Knowing how to check directory sizes in Linux is essential for managing disk space and…

4 days ago

Essential Commands for Linux User Listing

Managing user accounts is a core responsibility for any Linux administrator. Whether you’re securing a…

4 days ago

Command-Line Techniques for Listing Linux Users

Linux offers powerful command-line tools for system administrators to view and manage user accounts. Knowing…

5 days ago