PE File Format

[xroot]

Running an "exe" from memory sounds interesting. Reading all about the PE file format,

and other examples, I tried and failed. I get an error "299" ERROR_PARTIAL_COPY

on a WriteProcessMemory call. The compete error message is:

"Only part of a ReadProcessMemory or WriteProcessMemory request was completed".

With the same code logic I wrote this com dll wrapper and it works just fine.

Not sure why the au3 fails and the com dll works? I quess this will be work in progress.

Here is how you run the wrapper.

$exe=ObjCreate("RunPE.RunPEc")

$fp=FileOpen(@SYSTEMDIR&"\notepad.exe",16) ;Open any "exe" you want in binary

$exe.RunPE(StringMid(FileRead($fp),3)) ;bypass 0x just send the binary(bytes)

FileClose($fp)

Be sure to register the RunPe.dll.

RunPE.zip

[Richard Robertson]

I can only see this being used badly.

[JRSmile]

i will use this at its best by utilizing cui programs which interact with my main process via tcp ip, or window message struck handshake, don't know yet but the possebillities are great.

[JRSmile]

while playing around with your com object, i found out that every time i utillize your function a cmd.exe is spawned, can you tell my why this is necessary?

Edited July 29, 2008 by JRSmile

[Michel Claveau]

Hi!

Impossible to obtain something for me.

I launch example ("C:\Windows\System32\notepad.exe",16) ; data are in mem (302082 bytes), but .RunPE give... nothing.

Perhaps because I use vista? Perhaps I use a french Windows? Perhaps other thing?

Any idea?

Edited July 30, 2008 by Michel Claveau

[xroot]

I have not tested the dll on Vista and most likely not to work.

What ever you run with the dll the "cmd" is what's fired. You will

not see the program you ran (notepad.exe). I set up the process

with a CreateProcess with "cmd.exe" in CREATE_SUSPENDED mode.

I then do all the ReadMemory, MoveMemory, VirtualAllocEx,

WriteMemory, of (notepad.exe) then ResumeThread, done.