Home > Backend Development > C++ > body text

Can CreateProcess Execute an EXE Directly from Memory Without Saving It to a File?

Susan Sarandon
Release: 2024-11-02 13:05:02
Original
394 people have browsed it

Can CreateProcess Execute an EXE Directly from Memory Without Saving It to a File?

CreateProcess from Memory Buffer

Question:

Can one invoke CreateProcess on the contents of an EXE stored in a memory buffer, without writing it to a file first?

Background:

In an attempt to bypass DRM delays in patching game crashes, a method is sought to decrypt and launch a real EXE from within an external EXE.

Answer:

CreateProcess can indeed be invoked on a memory buffer containing an EXE, allowing for its execution without prior file writing. The steps involve:

  1. Suspending the process using CreateProcess with the CREATE_SUSPENDED flag.
  2. Retrieving the thread context using GetThreadContext, with the PEB's ImageBaseAddress stored at [EBX 8].
  3. Comparing the base addresses and image sizes of the suspended process and in-memory EXE.
  4. Writing the in-memory EXE into the suspended process's memory using WriteProcessMemory if conditions allow.
  5. Unmapping the original image, allocating memory in the suspended process, and writing the in-memory EXE if conditions do not allow.
  6. Patching the base address and entry point in the thread context.
  7. Resuming the suspended process using ResumeThread.

The above is the detailed content of Can CreateProcess Execute an EXE Directly from Memory Without Saving It to a File?. For more information, please follow other related articles on the PHP Chinese website!

source:php.cn
Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
Latest Articles by Author
Popular Tutorials
More>
Latest Downloads
More>
Web Effects
Website Source Code
Website Materials
Front End Template
About us Disclaimer Sitemap
php.cn:Public welfare online PHP training,Help PHP learners grow quickly!