No longer seems to work in latest windows 11 update

[jarroddavis68]

Hi, using the ideas and concepts outlined here, I made a Delphi version, and it was working fine. However, a recent Windows 11 update seems to render this technique nonfunctional. Any ideas for a possible fix?

here is the repo to the Delphi version I made:
https://github.com/tinyBigGAMES/MemoryDLL

[A-Normal-User]

Hello! After I upgraded to version 24H2, I also experienced a situation where it was not possible to use my program.
But more interest. Today, after I uninstalled Windows Defender and disabled Virtualization-based Security, I was able to use it normally. I suspect that a certain setting (or a new security policy) within the security center might have been responsible for this issue.

[jarroddavis68]

I think this maybe the issue, I just do not know yet how to apply it to my code, which is based on your code:

Microsoft introduced a change in the loader's behavior where, if your NtMapViewOfSection hook
returns STATUS_IMAGE_NOT_AT_BASE, the loader will automatically attempt to remap the section
one more time. To handle this, you need to ensure your hook remains active during this
additional remapping attempt.

my HookNtMapViewOfSection routine only seems to be called once. I map the dll to memory, then exit, at the point, it returns 0 which indicated a failure. If do not call suspend/restore, it will just crash with a stack overflow.

function MemoryLoadLibrary(const AData: Pointer): THandle;
begin
  // Enter critical section to ensure thread-safe operations
  CriticalSection.Enter();
  try
    // Start hooking the NtOpenFile function in ntdll.dll with HookNtOpenFile as the replacement
    NtOpenFileHook.Start('ntdll.dll', 'NtOpenFile', @HookNtOpenFile);
    DllData := AData; // Store the DLL data pointer
    Result := LoadLibraryW(HOOK_REFERENCE_DLL); // Load the reference DLL using wide-character API
  finally
    // Leave the critical section after operations are complete
    CriticalSection.Leave();
  end;
end;

the LoadLibraryW call will always return zero, before 24H2, it just worked as expected.