A lightweight native DLL mapping library that supports mapping directly from memory
Features
- Imports and delay imports are resolved
- Relocations are performed
- Image sections are mapped with the correct page protection
- Exception handlers are initialised
- A security cookie is generated and initialised
- DLL entry point and TLS callbacks are called
Getting started
The example below demonstrates a simple implementation of the library
var libraryMapper = new LibraryMapper(process, dllBytes);
// Map the DLL into the process
libraryMapper.MapLibrary();
// Unmap the DLL from the process
libraryMapper.UnmapLibrary();Constructors
LibraryMapper(Process, Memory<byte>)LibraryMapper(Process, string)Properties
DllBaseAddressMethods
MapLibrary()UnmapLibrary()Caveats
- Mapping requires the presence of a PDB for ntdll.dll, and, so, the library will automatically download the latest version of this PDB from the Microsoft symbol server and cache it in
%appdata%/Lunar/Dependencies