LoadLibrary vs loading binary dll into process?

Question

I tried using ifstream to get the contents of my dll file to be injected into a remote process. I used a char* buffer to store the contents of the dll and then used WriteProcessMemory to inject the binary of the dll file into the process. I used CheatEngine to look at the memory region pointed to by the result of VirtualAllocEx so I know the data got written because I see a text parameter of one of the functions I made. I'm just curious what it is that LoadLibrary does differently from just loading the raw binary of the dll into the process.

Answer 1

In short, LoadLibrary does the following things:

1. Map and relocate sections in memory.

2. Deal with the Import Descriptor Table, load any dependencies (if necessary), and fill the Import Address Table (IAT).

3. Write necessary information to the Process Environment Block (PEB) so that you can find the module in module list.

4. Call module load notifies (usually in kernel).

5. Cleanup for a new module context.

6. Create an activation context (if there is a manifest).

7. Call the entry point (DllMain), if it exists.