can PB launch a included EXE file ?

PB · Post by PB » Fri Sep 02, 2005 1:18 pm

> I just think you should have noticed that when you see the Ashserv wich is
> an avast service

I did notice that but thought it was simply Avast doing a real-time file check
of a file that UPX decompressed to Temp. That's why I thought UPX wasn't
unpacking/running in memory. My mistake, but as you can see, I wasn't
intentionally telling lies.

I'll admit I took too much offense to your comments. The situation is this:
I'm currently sick with the flu, and off work (since Tuesday). I'm only paid
casual and don't get paid for these 4 days off, so I'm losing a lot of money
this week. Then I get told I'm telling "bullshit" on my favorite forums... so
you can see why I reacted angrily.

Anyway, let's just forget it... I take
back what I said about staying away from me in future. I'm sorry I said it.

thefool · Post by **thefool** » Fri Sep 02, 2005 1:20 pm

PB wrote:> I just think you should have noticed that when you see the Ashserv wich is
> an avast service

I did notice that but thought it was simply Avast doing a real-time file check
of a file that UPX decompressed to Temp. That's why I thought UPX wasn't
unpacking/running in memory. My mistake, but as you can see, I wasn't
intentionally telling lies.

I'll admit I took too much offense to your comments. The situation is this:
I'm currently sick with the flu, and off work (since Tuesday). I'm only paid
casual and don't get paid for these 4 days off, so I'm losing a lot of money
this week. Then I get told I'm telling "bullshit" on my favorite forums... so
you can see why I reacted angrily. Anyway, let's just forget it... I take
back what I said about staying away from me in future. I'm sorry I said it.

Oh.. Well again i will apologize as it wasnt bullshit.. Sound like your life isnt too funny at the moment..
K lets forget it

okasvi · Post by **okasvi** » Fri Sep 02, 2005 7:21 pm

UPX just unpacks runtime... |:

it does encrypt file and reloc EP to end of file where it will decrypt it and then goes pack to EP... or something like that |:

and that loadexe example does create new process with CREATE_SUSPENDED and then it does write exe to memory of created process and then jumps into its EP i guess... |:

still im looking for help to inject code to another running process (no dll) |:

Maxus · Post by **Maxus** » Fri May 26, 2006 7:44 am

Greetings.
Well still to whom be interesting this theme?
Who could be to start EXE not writing down on HDD?

I have tried to realize it and at me which that has turned out.