直接运行内存中的程序

た入场券 2022-09-19 08:19 192阅读 0赞

Windows的PE加载器在启动程序的时候，会将磁盘上的文件加载到内存，然后做很多操作，如函数导入表重定位，变量预处理之类的。这位仁兄等于是自己写了一个PE加载器。直接将内存中的程序启动。记得以前的“红色代码”病毒也有相同的特性。  
 直接启动内存中的程序相当于加了一个壳，可以把程序加密保存，运行时解密到内存，然后启动，不过对于增加破解难度还要稍微复杂点。否则人家把内存中的进程DUMP出来然后修复导入表就被拖出来了。

![None.gif][] \#include  " stdafx.h "   
![None.gif][]  
![None.gif][]  
![None.gif][]typedef IMAGE\_SECTION\_HEADER ( \* PIMAGE\_SECTION\_HEADERS)\[ 1 \];  
![None.gif][]  
![None.gif][] //  计算对齐后的大小    
![None.gif][] unsigned  long  GetAlignedSize(unsigned  long  Origin, unsigned  long  Alignment)  
![ExpandedBlockStart.gif][] \{  
![InBlock.gif][]return (Origin \+ Alignment \-1) / Alignment \* Alignment;  
![ExpandedBlockEnd.gif][]\}   
![None.gif][]  
![None.gif][] //  计算加载pe并对齐需要占用多少内存    
![None.gif][]//  未直接使用OptionalHeader.SizeOfImage作为结果是因为据说有的编译器生成的exe这个值会填0    
![None.gif][] unsigned  long  CalcTotalImageSize(PIMAGE\_DOS\_HEADER MzH  
![None.gif][] , unsigned  long  FileLen  
![None.gif][] , PIMAGE\_NT\_HEADERS peH  
![None.gif][] , PIMAGE\_SECTION\_HEADERS peSecH)  
![ExpandedBlockStart.gif][] \{  
![InBlock.gif][] unsigned long res;  
![InBlock.gif][]// 计算pe头的大小   
![InBlock.gif][] res = GetAlignedSize( peH\->OptionalHeader.SizeOfHeaders  
![InBlock.gif][] , peH\->OptionalHeader.SectionAlignment  
![InBlock.gif][] );  
![InBlock.gif][]  
![InBlock.gif][]// 计算所有节的大小   
![InBlock.gif][]for( int i =0; i < peH\->FileHeader.NumberOfSections; \++i)  
![ExpandedSubBlockStart.gif][]\{  
![InBlock.gif][]// 超出文件范围   
![InBlock.gif][]if(peSecH\[i\]\->PointerToRawData \+ peSecH\[i\]\->SizeOfRawData > FileLen)  
![InBlock.gif][]return0;  
![InBlock.gif][]elseif(peSecH\[i\]\->VirtualAddress)//计算对齐后某节的大小   
![ExpandedSubBlockStart.gif][]\{  
![InBlock.gif][]if(peSecH\[i\]\->Misc.VirtualSize)  
![ExpandedSubBlockStart.gif][]\{  
![InBlock.gif][] res = GetAlignedSize( peSecH\[i\]\->VirtualAddress \+ peSecH\[i\]\->Misc.VirtualSize  
![InBlock.gif][] , peH\->OptionalHeader.SectionAlignment  
![InBlock.gif][] );  
![ExpandedSubBlockEnd.gif][] \}  
![InBlock.gif][]else  
![ExpandedSubBlockStart.gif][]\{  
![InBlock.gif][] res = GetAlignedSize( peSecH\[i\]\->VirtualAddress \+ peSecH\[i\]\->SizeOfRawData  
![InBlock.gif][] , peH\->OptionalHeader.SectionAlignment  
![InBlock.gif][] );  
![ExpandedSubBlockEnd.gif][] \}  
![ExpandedSubBlockEnd.gif][] \}  
![InBlock.gif][]elseif( peSecH\[i\]\->Misc.VirtualSize < peSecH\[i\]\->SizeOfRawData )  
![ExpandedSubBlockStart.gif][]\{  
![InBlock.gif][] res \+= GetAlignedSize( peSecH\[i\]\->SizeOfRawData  
![InBlock.gif][] , peH\->OptionalHeader.SectionAlignment  
![InBlock.gif][] );  
![ExpandedSubBlockEnd.gif][] \}  
![InBlock.gif][]else  
![ExpandedSubBlockStart.gif][]\{  
![InBlock.gif][] res \+= GetAlignedSize( peSecH\[i\]\->Misc.VirtualSize  
![InBlock.gif][] , peH\->OptionalHeader.SectionAlignment  
![InBlock.gif][] );  
![ExpandedSubBlockEnd.gif][] \}// if\_else   
![ExpandedSubBlockEnd.gif][] \}// for   
![InBlock.gif][]  
![InBlock.gif][]return res;  
![ExpandedBlockEnd.gif][]\}   
![None.gif][]  
![None.gif][]  
![None.gif][]  
![None.gif][]  
![None.gif][] //  加载pe到内存并对齐所有节    
![None.gif][] BOOL AlignPEToMem(  void  \* Buf  
![None.gif][] ,  long  Len  
![None.gif][] , PIMAGE\_NT\_HEADERS  & peH  
![None.gif][] , PIMAGE\_SECTION\_HEADERS  & peSecH  
![None.gif][] ,  void  \*& Mem  
![None.gif][] , unsigned  long  & ImageSize)  
![ExpandedBlockStart.gif][] \{  
![InBlock.gif][] PIMAGE\_DOS\_HEADER SrcMz;// DOS头   
![InBlock.gif][] PIMAGE\_NT\_HEADERS SrcPeH;// PE头   
![InBlock.gif][] PIMAGE\_SECTION\_HEADERS SrcPeSecH;// 节表   
![InBlock.gif][]  
![InBlock.gif][] SrcMz = (PIMAGE\_DOS\_HEADER)Buf;  
![InBlock.gif][]  
![InBlock.gif][]if( Len < sizeof(IMAGE\_DOS\_HEADER) )  
![InBlock.gif][]return FALSE;  
![InBlock.gif][]  
![InBlock.gif][]if( SrcMz\->e\_magic != IMAGE\_DOS\_SIGNATURE )  
![InBlock.gif][]return FALSE;  
![InBlock.gif][]  
![InBlock.gif][]if( Len < SrcMz\->e\_lfanew \+ (long)sizeof(IMAGE\_NT\_HEADERS) )  
![InBlock.gif][]return FALSE;  
![InBlock.gif][]  
![InBlock.gif][] SrcPeH = (PIMAGE\_NT\_HEADERS)((int)SrcMz \+ SrcMz\->e\_lfanew);  
![InBlock.gif][]if( SrcPeH\->Signature != IMAGE\_NT\_SIGNATURE )  
![InBlock.gif][]return FALSE;  
![InBlock.gif][]  
![InBlock.gif][]if( (SrcPeH\->FileHeader.Characteristics & IMAGE\_FILE\_DLL) ||  
![InBlock.gif][] (SrcPeH\->FileHeader.Characteristics & IMAGE\_FILE\_EXECUTABLE\_IMAGE ==0) ||  
![InBlock.gif][] (SrcPeH\->FileHeader.SizeOfOptionalHeader != sizeof(IMAGE\_OPTIONAL\_HEADER)) )  
![ExpandedSubBlockStart.gif][]\{  
![InBlock.gif][]return FALSE;  
![ExpandedSubBlockEnd.gif][] \}  
![InBlock.gif][]  
![InBlock.gif][]  
![InBlock.gif][] SrcPeSecH = (PIMAGE\_SECTION\_HEADERS)((int)SrcPeH \+ sizeof(IMAGE\_NT\_HEADERS));  
![InBlock.gif][] ImageSize = CalcTotalImageSize( SrcMz, Len, SrcPeH, SrcPeSecH);  
![InBlock.gif][]  
![InBlock.gif][]if( ImageSize ==0 )  
![InBlock.gif][]return FALSE;  
![InBlock.gif][]  
![InBlock.gif][] Mem = VirtualAlloc( NULL, ImageSize, MEM\_COMMIT, PAGE\_EXECUTE\_READWRITE); // 分配内存   
![InBlock.gif][]if( Mem != NULL )  
![ExpandedSubBlockStart.gif][]\{  
![InBlock.gif][]// 计算需要复制的PE头字节数   
![InBlock.gif][] unsigned long l = SrcPeH\->OptionalHeader.SizeOfHeaders;  
![InBlock.gif][]for( int i =0; i < SrcPeH\->FileHeader.NumberOfSections; \++i)  
![ExpandedSubBlockStart.gif][]\{  
![InBlock.gif][]if( (SrcPeSecH\[i\]\->PointerToRawData) &&  
![InBlock.gif][] (SrcPeSecH\[i\]\->PointerToRawData < l) )  
![ExpandedSubBlockStart.gif][]\{  
![InBlock.gif][] l = SrcPeSecH\[i\]\->PointerToRawData;  
![ExpandedSubBlockEnd.gif][] \}  
![ExpandedSubBlockEnd.gif][] \}  
![InBlock.gif][] memmove( Mem, SrcMz, l);  
![InBlock.gif][] peH = (PIMAGE\_NT\_HEADERS)((int)Mem \+ ((PIMAGE\_DOS\_HEADER)Mem)\->e\_lfanew);  
![InBlock.gif][] peSecH = (PIMAGE\_SECTION\_HEADERS)((int)peH \+ sizeof(IMAGE\_NT\_HEADERS));  
![InBlock.gif][]  
![InBlock.gif][]void\*Pt = (void\*)((unsigned long)Mem  
![InBlock.gif][]\+ GetAlignedSize( peH\->OptionalHeader.SizeOfHeaders  
![InBlock.gif][] , peH\->OptionalHeader.SectionAlignment)  
![InBlock.gif][] );  
![InBlock.gif][]  
![InBlock.gif][]for( i =0; i < peH\->FileHeader.NumberOfSections; \++i)  
![ExpandedSubBlockStart.gif][]\{  
![InBlock.gif][]// 定位该节在内存中的位置   
![InBlock.gif][]if(peSecH\[i\]\->VirtualAddress)  
![InBlock.gif][] Pt = (void\*)((unsigned long)Mem \+ peSecH\[i\]\->VirtualAddress);  
![InBlock.gif][]  
![InBlock.gif][]if(peSecH\[i\]\->SizeOfRawData)  
![ExpandedSubBlockStart.gif][]\{  
![InBlock.gif][]// 复制数据到内存   
![InBlock.gif][] memmove(Pt, (const void\*)((unsigned long)(SrcMz) \+ peSecH\[i\]\->PointerToRawData), peSecH\[i\]\->SizeOfRawData);  
![InBlock.gif][]if(peSecH\[i\]\->Misc.VirtualSize < peSecH\[i\]\->SizeOfRawData)  
![InBlock.gif][] Pt = (void\*)((unsigned long)Pt \+ GetAlignedSize(peSecH\[i\]\->SizeOfRawData, peH\->OptionalHeader.SectionAlignment));  
![InBlock.gif][]else// pt 定位到下一节开始位置   
![InBlock.gif][] Pt = (void\*)((unsigned long)Pt \+ GetAlignedSize(peSecH\[i\]\->Misc.VirtualSize, peH\->OptionalHeader.SectionAlignment));  
![ExpandedSubBlockEnd.gif][] \}  
![InBlock.gif][]else  
![ExpandedSubBlockStart.gif][]\{  
![InBlock.gif][] Pt = (void\*)((unsigned long)Pt \+ GetAlignedSize(peSecH\[i\]\->Misc.VirtualSize, peH\->OptionalHeader.SectionAlignment));  
![ExpandedSubBlockEnd.gif][] \}  
![ExpandedSubBlockEnd.gif][] \}  
![ExpandedSubBlockEnd.gif][] \}  
![InBlock.gif][]return TRUE;  
![ExpandedBlockEnd.gif][]\}   
![None.gif][]  
![None.gif][]  
![None.gif][]  
![None.gif][]typedef  void  \* (\_\_stdcall  \* pfVirtualAllocEx)(unsigned  long ,  void  \* , unsigned  long , unsigned  long , unsigned  long );  
![None.gif][]pfVirtualAllocEx MyVirtualAllocEx  =  NULL;  
![None.gif][]  
![None.gif][]BOOL IsNT()  
![ExpandedBlockStart.gif][] \{  
![InBlock.gif][]return MyVirtualAllocEx!=NULL;  
![ExpandedBlockEnd.gif][]\}   
![None.gif][]  
![None.gif][] //  生成外壳程序命令行    
![None.gif][] char  \* PrepareShellExe( char  \* CmdParam, unsigned  long  BaseAddr, unsigned  long  ImageSize)  
![ExpandedBlockStart.gif][] \{  
![InBlock.gif][]if(IsNT())  
![ExpandedSubBlockStart.gif][]\{  
![InBlock.gif][]char\*Buf =newchar\[256\];  
![InBlock.gif][] memset(Buf, 0, 256);  
![InBlock.gif][] GetModuleFileName(0, Buf, 256);  
![InBlock.gif][] strcat(Buf, CmdParam);  
![InBlock.gif][]return Buf; // 请记得释放内存;-)   
![ExpandedSubBlockEnd.gif][] \}  
![InBlock.gif][]else  
![ExpandedSubBlockStart.gif][]\{  
![InBlock.gif][]// Win98下的处理请参考原文;-)   
![InBlock.gif][]// http://community.csdn.net/Expert/topic/4416/4416252.xml?temp=8.709133E-03   
![InBlock.gif][]return NULL;  
![ExpandedSubBlockEnd.gif][] \}  
![ExpandedBlockEnd.gif][]\}   
![None.gif][]  
![None.gif][] //  是否包含可重定向列表    
![None.gif][] BOOL HasRelocationTable(PIMAGE\_NT\_HEADERS peH)  
![ExpandedBlockStart.gif][] \{  
![InBlock.gif][]return (peH\->OptionalHeader.DataDirectory\[IMAGE\_DIRECTORY\_ENTRY\_BASERELOC\].VirtualAddress)  
![InBlock.gif][]&& (peH\->OptionalHeader.DataDirectory\[IMAGE\_DIRECTORY\_ENTRY\_BASERELOC\].Size);  
![ExpandedBlockEnd.gif][]\}   
![None.gif][]  
![None.gif][]  
![None.gif][]  
![None.gif][]  
![None.gif][]\#pragma pack(push,  1 )  
![ExpandedBlockStart.gif][]typedef struct \{  
![InBlock.gif][] unsigned long VirtualAddress;  
![InBlock.gif][] unsigned long SizeOfBlock;  
![ExpandedBlockEnd.gif][]\}  \* PImageBaseRelocation;  
![None.gif][]\#pragma pack(pop)  
![None.gif][]  
![None.gif][] //  重定向PE用到的地址    
![None.gif][] void  DoRelocation(PIMAGE\_NT\_HEADERS peH,  void  \* OldBase,  void  \* NewBase)  
![ExpandedBlockStart.gif][] \{  
![InBlock.gif][] unsigned long Delta = (unsigned long)NewBase \- peH\->OptionalHeader.ImageBase;  
![InBlock.gif][] PImageBaseRelocation p = (PImageBaseRelocation)((unsigned long)OldBase  
![InBlock.gif][]\+ peH\->OptionalHeader.DataDirectory\[IMAGE\_DIRECTORY\_ENTRY\_BASERELOC\].VirtualAddress);  
![InBlock.gif][]while(p\->VirtualAddress \+ p\->SizeOfBlock)  
![ExpandedSubBlockStart.gif][]\{  
![InBlock.gif][] unsigned short\*pw = (unsigned short\*)((int)p \+ sizeof(\*p));  
![InBlock.gif][]for(unsigned int i=1; i <= (p\->SizeOfBlock \- sizeof(\*p)) /2; \++i)  
![ExpandedSubBlockStart.gif][]\{  
![ExpandedSubBlockStart.gif][]if((\*pw) &0xF000==0x3000)\{  
![InBlock.gif][] unsigned long\*t = (unsigned long\*)((unsigned long)(OldBase) \+ p\->VirtualAddress \+ ((\*pw) &0x0FFF));  
![InBlock.gif][]\*t \+= Delta;  
![ExpandedSubBlockEnd.gif][] \}  
![InBlock.gif][]\++pw;  
![ExpandedSubBlockEnd.gif][] \}  
![InBlock.gif][] p = (PImageBaseRelocation)pw;  
![ExpandedSubBlockEnd.gif][] \}  
![ExpandedBlockEnd.gif][]\}   
![None.gif][]  
![None.gif][] //  卸载原外壳占用内存    
![None.gif][] BOOL UnloadShell(HANDLE ProcHnd, unsigned  long  BaseAddr)  
![ExpandedBlockStart.gif][] \{  
![InBlock.gif][] typedef unsigned long (\_\_stdcall \*pfZwUnmapViewOfSection)(unsigned long, unsigned long);  
![InBlock.gif][] pfZwUnmapViewOfSection ZwUnmapViewOfSection = NULL;  
![InBlock.gif][] BOOL res = FALSE;  
![InBlock.gif][] HMODULE m = LoadLibrary("ntdll.dll");  
![ExpandedSubBlockStart.gif][]if(m)\{  
![InBlock.gif][] ZwUnmapViewOfSection = (pfZwUnmapViewOfSection)GetProcAddress(m, "ZwUnmapViewOfSection");  
![InBlock.gif][]if(ZwUnmapViewOfSection)  
![InBlock.gif][] res = (ZwUnmapViewOfSection((unsigned long)ProcHnd, BaseAddr) ==0);  
![InBlock.gif][] FreeLibrary(m);  
![ExpandedSubBlockEnd.gif][] \}  
![InBlock.gif][]return res;  
![ExpandedBlockEnd.gif][]\}   
![None.gif][]  
![None.gif][] //  创建外壳进程并获取其基址、大小和当前运行状态    
![None.gif][] BOOL CreateChild( char  \* Cmd, CONTEXT  & Ctx, HANDLE  & ProcHnd, HANDLE  & ThrdHnd,  
![None.gif][] unsigned  long  & ProcId, unsigned  long  & BaseAddr, unsigned  long  & ImageSize)  
![ExpandedBlockStart.gif][] \{  
![InBlock.gif][] STARTUPINFOA si;  
![InBlock.gif][] PROCESS\_INFORMATION pi;  
![InBlock.gif][] unsigned long old;  
![InBlock.gif][] MEMORY\_BASIC\_INFORMATION MemInfo;  
![InBlock.gif][] memset(&si, 0, sizeof(si));  
![InBlock.gif][] memset(&pi, 0, sizeof(pi));  
![InBlock.gif][] si.cb = sizeof(si);  
![InBlock.gif][]  
![InBlock.gif][] BOOL res = CreateProcess(NULL, Cmd, NULL, NULL, FALSE, CREATE\_SUSPENDED, NULL, NULL, &si, &pi); // 以挂起方式运行进程;   
![ExpandedSubBlockStart.gif][]if(res)\{  
![InBlock.gif][] ProcHnd = pi.hProcess;  
![InBlock.gif][] ThrdHnd = pi.hThread;  
![InBlock.gif][] ProcId = pi.dwProcessId;  
![InBlock.gif][]// 获取外壳进程运行状态，\[ctx.Ebx+8\]内存处存的是外壳进程的加载基址，ctx.Eax存放有外壳进程的入口地址   
![InBlock.gif][] Ctx.ContextFlags = CONTEXT\_FULL;  
![InBlock.gif][] GetThreadContext(ThrdHnd, &Ctx);  
![InBlock.gif][] ReadProcessMemory(ProcHnd, (void\*)(Ctx.Ebx\+8), &BaseAddr, sizeof(unsigned long), &old); // 读取加载基址   
![InBlock.gif][]void\*p = (void\*)BaseAddr;  
![InBlock.gif][]// 计算外壳进程占有的内存   
![InBlock.gif][]while(VirtualQueryEx(ProcHnd, p, &MemInfo, sizeof(MemInfo)))  
![ExpandedSubBlockStart.gif][]\{  
![InBlock.gif][]if(MemInfo.State = MEM\_FREE) break;  
![InBlock.gif][] p = (void\*)((unsigned long)p \+ MemInfo.RegionSize);  
![ExpandedSubBlockEnd.gif][] \}  
![InBlock.gif][] ImageSize = (unsigned long)p \- (unsigned long)BaseAddr;  
![ExpandedSubBlockEnd.gif][] \}  
![InBlock.gif][]return res;  
![ExpandedBlockEnd.gif][]\}   
![None.gif][]  
![None.gif][] //  创建外壳进程并用目标进程替换它然后执行    
![None.gif][] HANDLE AttachPE( char  \* CmdParam, PIMAGE\_NT\_HEADERS peH, PIMAGE\_SECTION\_HEADERS peSecH,  
![None.gif][] void  \* Ptr, unsigned  long  ImageSize, unsigned  long  & ProcId)  
![ExpandedBlockStart.gif][] \{  
![InBlock.gif][] HANDLE res = INVALID\_HANDLE\_VALUE;  
![InBlock.gif][] CONTEXT Ctx;  
![InBlock.gif][] HANDLE Thrd;  
![InBlock.gif][] unsigned long Addr, Size;  
![InBlock.gif][]char\*s = PrepareShellExe(CmdParam, peH\->OptionalHeader.ImageBase, ImageSize);  
![InBlock.gif][]if(s==NULL) return res;  
![ExpandedSubBlockStart.gif][]if(CreateChild(s, Ctx, res, Thrd, ProcId, Addr, Size))\{  
![InBlock.gif][]void\*p = NULL;  
![InBlock.gif][] unsigned long old;  
![ExpandedSubBlockStart.gif][]if((peH\->OptionalHeader.ImageBase == Addr) && (Size >= ImageSize))\{ // 外壳进程可以容纳目标进程并且加载地址一致   
![InBlock.gif][] p = (void\*)Addr;  
![InBlock.gif][] VirtualProtectEx(res, p, Size, PAGE\_EXECUTE\_READWRITE, &old);  
![ExpandedSubBlockEnd.gif][] \}  
![ExpandedSubBlockStart.gif][]elseif(IsNT())\{  
![ExpandedSubBlockStart.gif][]if(UnloadShell(res, Addr))\{ // 卸载外壳进程占有内存   
![InBlock.gif][] p = MyVirtualAllocEx((unsigned long)res, (void\*)peH\->OptionalHeader.ImageBase, ImageSize, MEM\_RESERVE | MEM\_COMMIT, PAGE\_EXECUTE\_READWRITE);  
![ExpandedSubBlockEnd.gif][] \}  
![ExpandedSubBlockStart.gif][]if((p == NULL) && HasRelocationTable(peH))\{ // 分配内存失败并且目标进程支持重定向   
![InBlock.gif][] p = MyVirtualAllocEx((unsigned long)res, NULL, ImageSize, MEM\_RESERVE | MEM\_COMMIT, PAGE\_EXECUTE\_READWRITE);  
![InBlock.gif][]if(p) DoRelocation(peH, Ptr, p); // 重定向   
![ExpandedSubBlockEnd.gif][] \}  
![ExpandedSubBlockEnd.gif][] \}  
![ExpandedSubBlockStart.gif][]if(p)\{  
![InBlock.gif][] WriteProcessMemory(res, (void\*)(Ctx.Ebx\+8), &p, sizeof(DWORD), &old); // 重置目标进程运行环境中的基址   
![InBlock.gif][] peH\->OptionalHeader.ImageBase = (unsigned long)p;  
![ExpandedSubBlockStart.gif][]if(WriteProcessMemory(res, p, Ptr, ImageSize, &old))\{ // 复制PE数据到目标进程   
![InBlock.gif][] Ctx.ContextFlags = CONTEXT\_FULL;  
![InBlock.gif][]if((unsigned long)p == Addr)  
![InBlock.gif][] Ctx.Eax = peH\->OptionalHeader.ImageBase \+ peH\->OptionalHeader.AddressOfEntryPoint; // 重置运行环境中的入口地址   
![InBlock.gif][]else  
![InBlock.gif][] Ctx.Eax = (unsigned long)p \+ peH\->OptionalHeader.AddressOfEntryPoint;  
![InBlock.gif][] SetThreadContext(Thrd, &Ctx);// 更新运行环境   
![InBlock.gif][] ResumeThread(Thrd);// 执行   
![InBlock.gif][] CloseHandle(Thrd);  
![ExpandedSubBlockEnd.gif][] \}  
![ExpandedSubBlockStart.gif][]else\{ // 加载失败,杀掉外壳进程   
![InBlock.gif][] TerminateProcess(res, 0);  
![InBlock.gif][] CloseHandle(Thrd);  
![InBlock.gif][] CloseHandle(res);  
![InBlock.gif][] res = INVALID\_HANDLE\_VALUE;  
![ExpandedSubBlockEnd.gif][] \}  
![ExpandedSubBlockEnd.gif][] \}  
![ExpandedSubBlockStart.gif][]else\{ // 加载失败,杀掉外壳进程   
![InBlock.gif][] TerminateProcess(res, 0);  
![InBlock.gif][] CloseHandle(Thrd);  
![InBlock.gif][] CloseHandle(res);  
![InBlock.gif][] res = INVALID\_HANDLE\_VALUE;  
![ExpandedSubBlockEnd.gif][] \}  
![ExpandedSubBlockEnd.gif][] \}  
![InBlock.gif][]delete\[\] s;  
![InBlock.gif][]return res;  
![ExpandedBlockEnd.gif][]\}   
![None.gif][]  
![None.gif][]  
![None.gif][]  
![None.gif][]  
![ExpandedBlockStart.gif][] /\*\*/ /\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
![InBlock.gif][]\{ \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* \}  
![InBlock.gif][]\{ \* 从内存中加载并运行exe \* \}  
![InBlock.gif][]\{ \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* \}  
![InBlock.gif][]\{ \* 参数： \}  
![InBlock.gif][]\{ \* Buffer: 内存中的exe地址 \}  
![InBlock.gif][]\{ \* Len: 内存中exe占用长度 \}  
![InBlock.gif][]\{ \* CmdParam: 命令行参数(不包含exe文件名的剩余命令行参数）\}  
![InBlock.gif][]\{ \* ProcessId: 返回的进程Id \}  
![InBlock.gif][]\{ \* 返回值： 如果成功则返回进程的Handle(ProcessHandle), \}  
![InBlock.gif][]\{ 如果失败则返回INVALID\_HANDLE\_VALUE \}  
![InBlock.gif][]\{ \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* \}  
![ExpandedBlockEnd.gif][] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*/   
![None.gif][]HANDLE MemExecute( void  \* ABuffer,  long  Len,  char  \* CmdParam, unsigned  long  \* ProcessId)  
![ExpandedBlockStart.gif][] \{  
![InBlock.gif][] HANDLE res = INVALID\_HANDLE\_VALUE;  
![InBlock.gif][] PIMAGE\_NT\_HEADERS peH;  
![InBlock.gif][] PIMAGE\_SECTION\_HEADERS peSecH;  
![InBlock.gif][]void\*Ptr;  
![InBlock.gif][] unsigned long peSz;  
![InBlock.gif][]if(AlignPEToMem(ABuffer, Len, peH, peSecH, Ptr, peSz))  
![ExpandedSubBlockStart.gif][]\{  
![InBlock.gif][] res = AttachPE(CmdParam, peH, peSecH, Ptr, peSz, \*ProcessId);  
![InBlock.gif][] VirtualFree(Ptr, peSz, MEM\_DECOMMIT);  
![ExpandedSubBlockEnd.gif][] \}  
![InBlock.gif][]return res;  
![ExpandedBlockEnd.gif][]\}   
![None.gif][]  
![None.gif][] //  初始化    
![None.gif][] class CInit  
![ExpandedBlockStart.gif][] \{  
![InBlock.gif][]public:  
![InBlock.gif][] CInit()  
![ExpandedSubBlockStart.gif][]\{  
![InBlock.gif][] MyVirtualAllocEx = (pfVirtualAllocEx)GetProcAddress(GetModuleHandle("Kernel32.dll"), "VirtualAllocEx");  
![ExpandedSubBlockEnd.gif][] \}  
![ExpandedBlockEnd.gif][]\} Init;  
![None.gif][]  
![None.gif][]  
![None.gif][]  
![None.gif][]  
![None.gif][] int  APIENTRY WinMain(HINSTANCE hInstance,  
![None.gif][] HINSTANCE hPrevInstance,  
![None.gif][] LPSTR lpCmdLine,  
![None.gif][] int  nCmdShow)  
![ExpandedBlockStart.gif][] \{  
![InBlock.gif][] HANDLE hFile = NULL;  
![InBlock.gif][] hFile = ::CreateFile( "f:/SourceFromCsdn2.exe"  
![InBlock.gif][] , FILE\_ALL\_ACCESS  
![InBlock.gif][] , 0  
![InBlock.gif][] , NULL  
![InBlock.gif][] , OPEN\_EXISTING  
![InBlock.gif][] , FILE\_ATTRIBUTE\_NORMAL  
![InBlock.gif][] , NULL  
![InBlock.gif][] );  
![InBlock.gif][]if( hFile == INVALID\_HANDLE\_VALUE )  
![InBlock.gif][]return\-1;  
![InBlock.gif][]  
![InBlock.gif][] ::SetFilePointer( hFile, 0, NULL, FILE\_BEGIN);  
![InBlock.gif][] DWORD dwFileSize = ::GetFileSize( hFile, NULL);  
![InBlock.gif][]  
![InBlock.gif][] LPBYTE pBuf =new BYTE\[dwFileSize\];  
![InBlock.gif][] memset( pBuf, 0, dwFileSize);  
![InBlock.gif][]  
![InBlock.gif][] DWORD dwNumberOfBytesRead =0;  
![InBlock.gif][] ::ReadFile( hFile  
![InBlock.gif][] , pBuf  
![InBlock.gif][] , dwFileSize  
![InBlock.gif][] , &dwNumberOfBytesRead  
![InBlock.gif][] , NULL  
![InBlock.gif][] );  
![InBlock.gif][]  
![InBlock.gif][] ::CloseHandle(hFile);  
![InBlock.gif][]  
![InBlock.gif][] unsigned long ulProcessId =0;  
![InBlock.gif][] MemExecute( pBuf, dwFileSize, "", &ulProcessId);  
![InBlock.gif][]delete\[\] pBuf;  
![InBlock.gif][]  
![InBlock.gif][]  
![InBlock.gif][]return0;  
![ExpandedBlockEnd.gif][]\}

[None.gif]: /images/20220828/90c9d74de30b432eaa948330415c7b8b.png
[ExpandedBlockStart.gif]: /images/20220828/4675774c65dc407d92fa99ff826c8797.png
[InBlock.gif]: /images/20220828/f47d0e4f7e0e4727ae9c74937d5b8c2f.png
[ExpandedBlockEnd.gif]: /images/20220828/8f5db6d686e4426b98308c3a8905d55b.png
[ExpandedSubBlockStart.gif]: /images/20220828/fe8a9387584245789b245bcd9b9ed9c0.png
[ExpandedSubBlockEnd.gif]: /images/20220828/31ad808d9f6e44a9bd4d1568e81cc85e.png