Is it possible to get a file handle from memory?

Question

Windows

There is a dynamic library image loaded into memory. Is it possible to get its handle somehow, bypassing dynamic loading via winapi?

Answer 1

From the system's point of view, dynamic linking is more a process of working with pages of memory than with a file, it is very similar to working with a swap file. The process does not have file handles for dynamic libraries, the process works with the base address of the library in the address space. Handles are "hidden" inside the system, so you cannot slip them into the dynamic linking process. For dynamic linking, it is not enough to simply map the contents of a file into memory.
To implement the functionality equivalent to dynamic linking, you'll have to do the dynamic linking process manually: i.e. map the required part of the PE file to memory, set the necessary attributes for it (for example, mark the code as executable), load the necessary DLLs and fill in the import table and call DLLMain. An example of the code that does this can be found, for example, here:
https://www.codeproject.com/Tips/430684/Loading-Wi...
In this case, you may have to bypass any additional protection mechanisms in new versions of Windows and explain to antiviruses that you have no bad intentions.
If you want to exclude exactly the operation of opening a file, and at the same time do not feel sorry for the memory, you can allocate memory and copy the contents of the "pseudo-DLL" to the memory buffer from .data instead of mapping the file to memory. It will not work to use the existing .data mapping in memory to perform dynamic linking directly in it.