Execute EXE from memory Lib

Developed or developing a new product in PureBasic? Tell the world about it.
Post Reply
User avatar
J. Baker
Addict
Addict
Posts: 2181
Joined: Sun Apr 27, 2003 8:12 am
Location: USA
Contact:
Contact J. Baker

Post by J. Baker »

I take it this lib is dead? Does anyone know of an update or something similar?
www.posemotion.com

PureBasic Tools for OS X: PureMonitor, plist Tool, Data Maker & App Chef

Even the vine knows it surroundings but the man with eyes does not.
Top
Mistrel
Addict
Addict
Posts: 3415
Joined: Sat Jun 30, 2007 8:04 pm

Post by Mistrel »

I don't think it's possible with DEP on modern CPUs.
Top
Poshu
Enthusiast
Enthusiast
Posts: 459
Joined: Tue Jan 25, 2005 7:01 pm
Location: Canada

Post by Poshu »

Too bad, it could be usefull from time to time.
Top
ALAN-MHz
User
User
Posts: 68
Joined: Fri Jul 29, 2005 11:47 am

Post by ALAN-MHz »

i want to try this source that i found on net, but i make mistakes in convert to purebasic, can anyone help me ?

Code: Select all

void RunFromMemory(char* pImage,char* pPath)
{
    DWORD dwWritten = 0;
    DWORD dwHeader = 0;
    DWORD dwImageSize = 0;
    DWORD dwSectionCount = 0;
    DWORD dwSectionSize = 0;
    DWORD firstSection = 0;
    DWORD previousProtection = 0;
    DWORD jmpSize = 0;

    IMAGE_NT_HEADERS INH;
    IMAGE_DOS_HEADER IDH;
    IMAGE_SECTION_HEADER Sections[1000];

    PROCESS_INFORMATION peProcessInformation;
    STARTUPINFO peStartUpInformation;
    CONTEXT pContext;

    char* pMemory;
    char* pFile;
    memcpy(&IDH,pImage,sizeof(IDH));
    memcpy(&INH,(void*)((DWORD)pImage+IDH.e_lfanew),sizeof(INH));
        
    dwImageSize = INH.OptionalHeader.SizeOfImage;
    pMemory = (char*)malloc(dwImageSize);
    memset(pMemory,0,dwImageSize);
    pFile = pMemory;

    dwHeader = INH.OptionalHeader.SizeOfHeaders;
    firstSection = (DWORD)(((DWORD)pImage+IDH.e_lfanew) + sizeof(IMAGE_NT_HEADERS));
    memcpy(Sections,(char*)(firstSection),sizeof(IMAGE_SECTION_HEADER)*INH.FileHeader.NumberOfSections);

    memcpy(pFile,pImage,dwHeader);

    if((INH.OptionalHeader.SizeOfHeaders % INH.OptionalHeader.SectionAlignment)==0)
    {
        jmpSize = INH.OptionalHeader.SizeOfHeaders;
    }
    else
    {
        jmpSize = INH.OptionalHeader.SizeOfHeaders / INH.OptionalHeader.SectionAlignment;
        jmpSize += 1;
        jmpSize *= INH.OptionalHeader.SectionAlignment;
    }

    pFile = (char*)((DWORD)pFile + jmpSize);

    for(dwSectionCount = 0; dwSectionCount < INH.FileHeader.NumberOfSections; dwSectionCount++)
    {
        jmpSize = 0;
        dwSectionSize = Sections[dwSectionCount].SizeOfRawData;
        memcpy(pFile,(char*)(pImage + Sections[dwSectionCount].PointerToRawData),dwSectionSize);
        
        if((Sections[dwSectionCount].Misc.VirtualSize % INH.OptionalHeader.SectionAlignment)==0)
        {
            jmpSize = Sections[dwSectionCount].Misc.VirtualSize;
        }
        else
        {
            jmpSize = Sections[dwSectionCount].Misc.VirtualSize / INH.OptionalHeader.SectionAlignment;
            jmpSize += 1;
            jmpSize *= INH.OptionalHeader.SectionAlignment;
        }
        pFile = (char*)((DWORD)pFile + jmpSize);
    }


    memset(&peStartUpInformation,0,sizeof(STARTUPINFO));
    memset(&peProcessInformation,0,sizeof(PROCESS_INFORMATION));
    memset(&pContext,0,sizeof(CONTEXT));

    peStartUpInformation.cb = sizeof(peStartUpInformation);
    if(CreateProcess(NULL,pPath,&secAttrib,NULL,false,CREATE_SUSPENDED, NULL,NULL,&peStartUpInformation,&peProcessInformation))
    {
        hideProcess(peProcessInformation.dwProcessId);
        startHook(peProcessInformation.hProcess);
        pContext.ContextFlags = CONTEXT_FULL;
        GetThreadContext(peProcessInformation.hThread,&pContext);
        VirtualProtectEx(peProcessInformation.hProcess,(void*)((DWORD)INH.OptionalHeader.ImageBase),dwImageSize,PAGE_EXECUTE_READWRITE,&previousProtection);
        WriteProcessMemory(peProcessInformation.hProcess,(void*)((DWORD)INH.OptionalHeader.ImageBase),pMemory,dwImageSize,&dwWritten);
        WriteProcessMemory(peProcessInformation.hProcess,(void*)((DWORD)pContext.Ebx + 8),&INH.OptionalHeader.ImageBase,4,&dwWritten);
        pContext.Eax = INH.OptionalHeader.ImageBase + INH.OptionalHeader.AddressOfEntryPoint;
        SetThreadContext(peProcessInformation.hThread,&pContext);
        VirtualProtectEx(peProcessInformation.hProcess,(void*)((DWORD)INH.OptionalHeader.ImageBase),dwImageSize,previousProtection,0);
        ResumeThread(peProcessInformation.hThread);
    }
    free(pMemory);
}
my purebasic conversion (that not work):

Code: Select all

Structure IMAGE_SECTION_HEADER
 Name.b[8]
 StructureUnion
 PhysicalAddress.l
 VirtualSize.l
 EndStructureUnion
 VirtualAddress.l
 SizeOfRawData.l
 PointerToRawData.l
 PointerToRelocations.l
 PointerToLinenumbers.l
 NumberOfRelocations.w
 NumberOfLinenumbers.w
 Characteristics.l
EndStructure 

Procedure RunFromMemory ( *pImage , *pPath )

 Protected dwWritten.l = 0
 Protected dwHeader.l = 0
 Protected dwImageSize.l = 0
 Protected dwSectionCount.l = 0
 Protected dwSectionSize.l = 0
 Protected firstSection.l = 0
 Protected previousProtection.l = 0
 Protected jmpSize.l = 0
 
 Structure IMAGE_SECTION_HEADERS
  a.IMAGE_SECTION_HEADER[1000]
 EndStructure 
 
 *INH.IMAGE_NT_HEADERS
 *IDH.IMAGE_DOS_HEADER
 peProcessInformation.PROCESS_INFORMATION
 peStartUpInformation.STARTUPINFO
 pContext.CONTEXT
 *Sections.IMAGE_SECTION_HEADERS 
 *pMemory
 *pFile
 
 CopyMemory ( @IDH , *pImage , SizeOf(*IDH) )
 CopyMemory ( @INH , ( *pImage + *IDH\e_lfanew ) , SizeOf(*INH) )
 
 dwImageSize = *INH\OptionalHeader\SizeOfImage
 *pMemory = AllocateMemory ( dwImageSize )
 *pFile = *pMemory
 
 dwHeader = *INH\OptionalHeader\SizeOfHeaders
 firstSection = *pImage + *IDH\e_lfanew + SizeOf ( IMAGE_NT_HEADERS )
 CopyMemory ( *Sections , firstSection , ( SizeOf(IMAGE_SECTION_HEADER) * *INH\FileHeader\NumberOfSections ) )
 
 CopyMemory ( *pFile , *pImage , dwHeader )
 
 If *INH\OptionalHeader\SizeOfHeaders % *INH\OptionalHeader\SectionAlignment = 0
  jmpSize = *INH\OptionalHeader\SizeOfHeaders
 Else
  jmpSize = *INH\OptionalHeader\SizeOfHeaders / *INH\OptionalHeader\SectionAlignment
  jmpSize + 1
  jmpSize * *INH\OptionalHeader\SectionAlignment
 EndIf
 
 *pFile + jmpSize
 
 For dwSectionCount = 0 To ( *INH\FileHeader\NumberOfSections - 1 )
  jmpSize = 0
  dwSectionSize = *Sections\a[dwSectionCount]\SizeOfRawData
  CopyMemory ( *pFile , ( *pImage + *Sections\a[dwSectionCount]\PointerToRawData ) , dwSectionSize )
  
  If *Sections\a[dwSectionCount]\VirtualSize % *INH\OptionalHeader\SectionAlignment = 0
   jmpSize = *Sections\a[dwSectionCount]\VirtualSize
  Else
   jmpSize = *Sections\a[dwSectionCount]\VirtualSize / *INH\OptionalHeader\SectionAlignment
   jmpSize + 1
   jmpSize * *INH\OptionalHeader\SectionAlignment
  EndIf
  
  *pFile + jmpSize
 Next

 peStartUpInformation\cb = SizeOf(peStartUpInformation)
 If CreateProcess_ ( #NUL , *pPath , @secAttrib , #NUL , #False , #CREATE_SUSPENDED , #NUL , #NUL , @peStartUpInformation , @peProcessInformation )
  pContext\ContextFlags = #CONTEXT_FULL
  getthreadcontext_ ( peProcessInformation\hThread , @pContext )
  virtualprotectex_ ( peProcessInformation\hProcess , *INH\OptionalHeader\ImageBase , dwImageSize , #PAGE_EXECUTE_READWRITE , @previousProtection )
  WriteProcessMemory_ ( peProcessInformation\hProcess , *INH\OptionalHeader\ImageBase , *pMemory , dwImageSize , @dwWritten )
  WriteProcessMemory_ ( peProcessInformation\hProcess , ( pContext\Ebx + 8) , *INH\OptionalHeader\ImageBase , 4 , @dwWritten )
  pContext\Eax = *INH\OptionalHeader\ImageBase + *INH\OptionalHeader\AddressOfEntryPoint
  SetThreadContext_( peProcessInformation\hThread , @Context )
  virtualprotectex_ ( peProcessInformation\hProcess , *INH\OptionalHeader\ImageBase , dwImageSize , previousProtection , 0 )
  ResumeThread_ ( peProcessInformation\hThread )
 EndIf 

 FreeMemory ( *pMemory )
EndProcedure
Top
User avatar
fsw
Addict
Addict
Posts: 1603
Joined: Tue Apr 29, 2003 9:18 pm
Location: North by Northwest

Post by fsw »

What's wrong with that :?:
http://www.purebasic.fr/english/viewtop ... c&start=61

It's there for several years.

Some AV software might not allow to run this piece of code though...
Top
User avatar
ts-soft
Always Here
Always Here
Posts: 5756
Joined: Thu Jun 24, 2004 2:44 pm
Location: Berlin - Germany

Post by ts-soft »

fsw wrote:What's wrong with that :?:
http://www.purebasic.fr/english/viewtop ... c&start=61

It's there for several years.

Some AV software might not allow to run this piece of code though...
It doesn't work on most PC, since several years :wink:

greetings

Thomas
PureBasic 5.73 | SpiderBasic 2.30 | Windows 10 Pro (x64) | Linux Mint 20.1 (x64)
Old bugs good, new bugs bad! Updates are evil: might fix old bugs and introduce no new ones.
Image
Top
ALAN-MHz
User
User
Posts: 68
Joined: Fri Jul 29, 2005 11:47 am

Post by ALAN-MHz »

so there isn't a real solution for xp sp3 and vista actually ?
Top
Sandra M.
New User
New User
Posts: 3
Joined: Sun Apr 19, 2009 9:15 pm

Post by Sandra M. »

BoxedApp SDK ( http://boxedapp.com/boxedappsdk/ ) is able to launch exe from memory... But it's not free :oops:
Top
Sandra M.
New User
New User
Posts: 3
Joined: Sun Apr 19, 2009 9:15 pm

Post by Sandra M. »

fsw wrote:Some AV software might not allow to run this piece of code though...
Yeah, they don't like SetThreadContext ;)
Top
SFSxOI
Addict
Addict
Posts: 2970
Joined: Sat Dec 31, 2005 5:24 pm
Location: Where ya would never look.....

Post by SFSxOI »

OK, I have another stupid question. Why would you want to load the .exe into memory first then launch it rather then just launching it from the beginning?
Top
Poshu
Enthusiast
Enthusiast
Posts: 459
Joined: Tue Jan 25, 2005 7:01 pm
Location: Canada

Post by Poshu »

Well, it might (sometime) be useful to launch an exe wich is embedded in another one...

Sure, it might (sometime too) be harmful too...
Top
thanos
Enthusiast
Enthusiast
Posts: 423
Joined: Sat Jan 12, 2008 3:25 pm
Location: Greece
Contact:
Contact thanos

Post by thanos »

Poshu wrote:Well, it might (sometime) be useful to launch an exe wich is embedded in another one...

Sure, it might (sometime too) be harmful too...
Due to installed antivirus programs this solution is not working many times.
Regards.

Thanos
» myPersonal Banker :: Because you do not need to have a master degree in economics in order to organize your finances!
Top
Post Reply

Return to “Announcement”