MemoryModulePP icon indicating copy to clipboard operation
MemoryModulePP copied to clipboard

when dll memory loadlibrary dll will be crash!

Open warsark opened this issue 3 years ago • 1 comments

1.the test.exe memload a.dll 2.a.dll compile with memorymodulepp.lib 3.in a.dll dllmain DLL_PROCESS_ATTACH memload b.dll

if use test.exe memlod b.dll it's ok! but use test.exe memload a.dll,in a.dll memload b.dll will crash in test.exe call a.dllmain

I comment //static const BOOL MmpStaticInitializer = MmpInitialize(); then call MmpInitialize before LdrLoadDllMemoryExW the a.dll load successful, but a.dll call MmpInitialize crash auto tls = CONTAINING_RECORD(NtCurrentTeb()->ThreadLocalStoragePointer, TLS_VECTOR, TLS_VECTOR::ModuleTlsData); if (tls && tls->Length > MMP_START_TLS_INDEX) { RtlRaiseStatus(STATUS_NOT_SUPPORTED);-->crash here return FALSE; }

warsark avatar Sep 07 '22 13:09 warsark

Hi. MMP maintains a private TLS list internally to support TLS without locating the LdrpHandleTlsData routine by signature. The MMP will take over the TlsVector for all threads in the process, so it can only be initialized once. If you must link statically in a different module, use the previous version of MMP that did not handle TLS. A good practice is to always link the MMP in the exe file and expose the MMP API as a function pointer.

bb107 avatar Sep 07 '22 14:09 bb107