VC2015,C++內存中運行EXE文件,點擊可以下載
VC2015項目中所用的源碼主要源自于網絡,修正一些錯誤后,源碼如下,此源碼在VC6中可以正常編譯,
但在VC2015中,就會出現一些錯誤,本項目源碼已經把錯誤修正,可以正常編譯并運行,感興趣的可以下載。
本例中默認調用C:\111.EXE,測試時,請在這個位置放一個可以正常打開的程序,運行本例程序即可正常調用。
主要源碼如下:
#include "stdafx.h"
#include "stdio.h"
#include "windows.h"typedef IMAGE_SECTION_HEADER(*PIMAGE_SECTION_HEADERS)[1];// 計算對齊后的大小
unsigned long GetAlignedSize(unsigned long Origin, unsigned long Alignment)
{return (Origin + Alignment - 1) / Alignment * Alignment;
}// 計算加載pe并對齊需要占用多少內存
// 未直接使用OptionalHeader.SizeOfImage作為結果是因為據說有的編譯器生成的exe這個值會填0
unsigned long CalcTotalImageSize(PIMAGE_DOS_HEADER MzH, unsigned long FileLen, PIMAGE_NT_HEADERS peH, PIMAGE_SECTION_HEADERS peSecH)
{unsigned long res;// 計算pe頭的大小 res = GetAlignedSize(peH->OptionalHeader.SizeOfHeaders, peH->OptionalHeader.SectionAlignment);// 計算所有節的大小 for (int i = 0; i < peH->FileHeader.NumberOfSections; ++i){// 超出文件范圍 if (peSecH[i]->PointerToRawData + peSecH[i]->SizeOfRawData > FileLen)return 0;else if (peSecH[i]->VirtualAddress)//計算對齊后某節的大小 {if (peSecH[i]->Misc.VirtualSize){res = GetAlignedSize(peSecH[i]->VirtualAddress + peSecH[i]->Misc.VirtualSize, peH->OptionalHeader.SectionAlignment);}else{res = GetAlignedSize(peSecH[i]->VirtualAddress + peSecH[i]->SizeOfRawData, peH->OptionalHeader.SectionAlignment);}}else if (peSecH[i]->Misc.VirtualSize < peSecH[i]->SizeOfRawData){res += GetAlignedSize(peSecH[i]->SizeOfRawData, peH->OptionalHeader.SectionAlignment);}else{res += GetAlignedSize(peSecH[i]->Misc.VirtualSize, peH->OptionalHeader.SectionAlignment);}// if_else }// for return res;
}// 加載pe到內存并對齊所有節
BOOL AlignPEToMem(void *Buf, long Len, PIMAGE_NT_HEADERS &peH, PIMAGE_SECTION_HEADERS &peSecH, void *&Mem, unsigned long &ImageSize)
{PIMAGE_DOS_HEADER SrcMz;// DOS頭 PIMAGE_NT_HEADERS SrcPeH;// PE頭 PIMAGE_SECTION_HEADERS SrcPeSecH;// 節表 SrcMz = (PIMAGE_DOS_HEADER)Buf;if (Len < sizeof(IMAGE_DOS_HEADER))return FALSE;if (SrcMz->e_magic != IMAGE_DOS_SIGNATURE)return FALSE;if (Len < SrcMz->e_lfanew + (long)sizeof(IMAGE_NT_HEADERS))return FALSE;SrcPeH = (PIMAGE_NT_HEADERS)((int)SrcMz + SrcMz->e_lfanew);if (SrcPeH->Signature != IMAGE_NT_SIGNATURE)return FALSE;if ((SrcPeH->FileHeader.Characteristics & IMAGE_FILE_DLL) ||(SrcPeH->FileHeader.Characteristics & IMAGE_FILE_EXECUTABLE_IMAGE == 0) ||(SrcPeH->FileHeader.SizeOfOptionalHeader != sizeof(IMAGE_OPTIONAL_HEADER))){return FALSE;}SrcPeSecH = (PIMAGE_SECTION_HEADERS)((int)SrcPeH + sizeof(IMAGE_NT_HEADERS));ImageSize = CalcTotalImageSize(SrcMz, Len, SrcPeH, SrcPeSecH);if (ImageSize == 0)return FALSE;Mem = VirtualAlloc(NULL, ImageSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE); // 分配內存 if (Mem != NULL){// 計算需要復制的PE頭字節數 unsigned long l = SrcPeH->OptionalHeader.SizeOfHeaders;for (int i = 0; i < SrcPeH->FileHeader.NumberOfSections; ++i){if ((SrcPeSecH[i]->PointerToRawData) && (SrcPeSecH[i]->PointerToRawData < l)){l = SrcPeSecH[i]->PointerToRawData;}}memmove(Mem, SrcMz, l);peH = (PIMAGE_NT_HEADERS)((int)Mem + ((PIMAGE_DOS_HEADER)Mem)->e_lfanew);peSecH = (PIMAGE_SECTION_HEADERS)((int)peH + sizeof(IMAGE_NT_HEADERS));void *Pt = (void *)((unsigned long)Mem+ GetAlignedSize(peH->OptionalHeader.SizeOfHeaders, peH->OptionalHeader.SectionAlignment));for (int i = 0; i < peH->FileHeader.NumberOfSections; ++i){// 定位該節在內存中的位置 if (peSecH[i]->VirtualAddress)Pt = (void *)((unsigned long)Mem + peSecH[i]->VirtualAddress);if (peSecH[i]->SizeOfRawData){// 復制數據到內存 memmove(Pt, (const void *)((unsigned long)(SrcMz)+peSecH[i]->PointerToRawData), peSecH[i]->SizeOfRawData);if (peSecH[i]->Misc.VirtualSize < peSecH[i]->SizeOfRawData)Pt = (void *)((unsigned long)Pt + GetAlignedSize(peSecH[i]->SizeOfRawData, peH->OptionalHeader.SectionAlignment));else // pt 定位到下一節開始位置 Pt = (void *)((unsigned long)Pt + GetAlignedSize(peSecH[i]->Misc.VirtualSize, peH->OptionalHeader.SectionAlignment));}else{Pt = (void *)((unsigned long)Pt + GetAlignedSize(peSecH[i]->Misc.VirtualSize, peH->OptionalHeader.SectionAlignment));}}}return TRUE;
}typedef void *(__stdcall *pfVirtualAllocEx)(unsigned long, void *, unsigned long, unsigned long, unsigned long);
pfVirtualAllocEx MyVirtualAllocEx = NULL;BOOL IsNT()
{return MyVirtualAllocEx != NULL;
}// 生成外殼程序命令行
char *PrepareShellExe(char *CmdParam, unsigned long BaseAddr, unsigned long ImageSize)
{if (IsNT()){char *Buf = new char[256];memset(Buf, 0, 256);GetModuleFileName(0, Buf, 256);strcat(Buf, CmdParam);return Buf; // 請記得釋放內存;-) }else{// Win98下的處理請參考原文;-) // http://community.csdn.net/Expert/topic/4416/4416252.xml?temp=8.709133E-03 return NULL;}
}// 是否包含可重定向列表
BOOL HasRelocationTable(PIMAGE_NT_HEADERS peH)
{return (peH->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress)&& (peH->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size);
}#pragma pack(push, 1)
typedef struct ImageBaseRelocation {unsigned long VirtualAddress;unsigned long SizeOfBlock;
}*PImageBaseRelocation;
#pragma pack(pop) // 重定向PE用到的地址
void DoRelocation(PIMAGE_NT_HEADERS peH, void *OldBase, void *NewBase)
{unsigned long Delta = (unsigned long)NewBase - peH->OptionalHeader.ImageBase;PImageBaseRelocation p = (PImageBaseRelocation)((unsigned long)OldBase+ peH->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress);while (p->VirtualAddress + p->SizeOfBlock){unsigned short *pw = (unsigned short *)((int)p + sizeof(*p));for (unsigned int i = 1; i <= (p->SizeOfBlock - sizeof(*p)) / 2; ++i){if ((*pw) & 0xF000 == 0x3000) {unsigned long *t = (unsigned long *)((unsigned long)(OldBase)+p->VirtualAddress + ((*pw) & 0x0FFF));*t += Delta;}++pw;}p = (PImageBaseRelocation)pw;}
}// 卸載原外殼占用內存
BOOL UnloadShell(HANDLE ProcHnd, unsigned long BaseAddr)
{typedef unsigned long(__stdcall *pfZwUnmapViewOfSection)(unsigned long, unsigned long);pfZwUnmapViewOfSection ZwUnmapViewOfSection = NULL;BOOL res = FALSE;HMODULE m = LoadLibrary("ntdll.dll");if (m) {ZwUnmapViewOfSection = (pfZwUnmapViewOfSection)GetProcAddress(m, "ZwUnmapViewOfSection");if (ZwUnmapViewOfSection)res = (ZwUnmapViewOfSection((unsigned long)ProcHnd, BaseAddr) == 0);FreeLibrary(m);}return res;
}// 創建外殼進程并獲取其基址、大小和當前運行狀態
BOOL CreateChild(char *Cmd, CONTEXT &Ctx, HANDLE &ProcHnd, HANDLE &ThrdHnd,unsigned long &ProcId, unsigned long &BaseAddr, unsigned long &ImageSize)
{STARTUPINFOA si;PROCESS_INFORMATION pi;unsigned long old;MEMORY_BASIC_INFORMATION MemInfo;memset(&si, 0, sizeof(si));memset(&pi, 0, sizeof(pi));si.cb = sizeof(si);BOOL res = CreateProcess(NULL, Cmd, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi); // 以掛起方式運行進程; if (res) {ProcHnd = pi.hProcess;ThrdHnd = pi.hThread;ProcId = pi.dwProcessId;// 獲取外殼進程運行狀態,[ctx.Ebx+8]內存處存的是外殼進程的加載基址,ctx.Eax存放有外殼進程的入口地址 Ctx.ContextFlags = CONTEXT_FULL;GetThreadContext(ThrdHnd, &Ctx);ReadProcessMemory(ProcHnd, (void *)(Ctx.Ebx + 8), &BaseAddr, sizeof(unsigned long), &old); // 讀取加載基址 void *p = (void *)BaseAddr;// 計算外殼進程占有的內存 while (VirtualQueryEx(ProcHnd, p, &MemInfo, sizeof(MemInfo))){if (MemInfo.State = MEM_FREE) break;p = (void *)((unsigned long)p + MemInfo.RegionSize);}ImageSize = (unsigned long)p - (unsigned long)BaseAddr;}return res;
}// 創建外殼進程并用目標進程替換它然后執行
HANDLE AttachPE(char *CmdParam, PIMAGE_NT_HEADERS peH, PIMAGE_SECTION_HEADERS peSecH,void *Ptr, unsigned long ImageSize, unsigned long &ProcId)
{HANDLE res = INVALID_HANDLE_VALUE;CONTEXT Ctx;HANDLE Thrd;unsigned long Addr, Size;char *s = PrepareShellExe(CmdParam, peH->OptionalHeader.ImageBase, ImageSize);if (s == NULL) return res;if (CreateChild(s, Ctx, res, Thrd, ProcId, Addr, Size)) {void *p = NULL;unsigned long old;if ((peH->OptionalHeader.ImageBase == Addr) && (Size >= ImageSize)) {// 外殼進程可以容納目標進程并且加載地址一致 p = (void *)Addr;VirtualProtectEx(res, p, Size, PAGE_EXECUTE_READWRITE, &old);}else if (IsNT()) {if (UnloadShell(res, Addr)) {// 卸載外殼進程占有內存 p = MyVirtualAllocEx((unsigned long)res, (void *)peH->OptionalHeader.ImageBase, ImageSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);}if ((p == NULL) && HasRelocationTable(peH)) {// 分配內存失敗并且目標進程支持重定向 p = MyVirtualAllocEx((unsigned long)res, NULL, ImageSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);if (p) DoRelocation(peH, Ptr, p); // 重定向 }}if (p) {WriteProcessMemory(res, (void *)(Ctx.Ebx + 8), &p, sizeof(DWORD), &old); // 重置目標進程運行環境中的基址 peH->OptionalHeader.ImageBase = (unsigned long)p;if (WriteProcessMemory(res, p, Ptr, ImageSize, &old)) {// 復制PE數據到目標進程 Ctx.ContextFlags = CONTEXT_FULL;if ((unsigned long)p == Addr)Ctx.Eax = peH->OptionalHeader.ImageBase + peH->OptionalHeader.AddressOfEntryPoint; // 重置運行環境中的入口地址 elseCtx.Eax = (unsigned long)p + peH->OptionalHeader.AddressOfEntryPoint;SetThreadContext(Thrd, &Ctx);// 更新運行環境 ResumeThread(Thrd);// 執行 CloseHandle(Thrd);}else {// 加載失敗,殺掉外殼進程 TerminateProcess(res, 0);CloseHandle(Thrd);CloseHandle(res);res = INVALID_HANDLE_VALUE;}}else {// 加載失敗,殺掉外殼進程 TerminateProcess(res, 0);CloseHandle(Thrd);CloseHandle(res);res = INVALID_HANDLE_VALUE;}}delete[] s;return res;
}/*******************************************************\
{ ******************************************************* }
{ * 從內存中加載并運行exe * }
{ ******************************************************* }
{ * 參數: }
{ * Buffer: 內存中的exe地址 }
{ * Len: 內存中exe占用長度 }
{ * CmdParam: 命令行參數(不包含exe文件名的剩余命令行參數)}
{ * ProcessId: 返回的進程Id }
{ * 返回值: 如果成功則返回進程的Handle(ProcessHandle), }
{ 如果失敗則返回INVALID_HANDLE_VALUE }
{ ******************************************************* }
\*******************************************************/
HANDLE MemExecute(void *ABuffer, long Len, char *CmdParam, unsigned long *ProcessId)
{HANDLE res = INVALID_HANDLE_VALUE;PIMAGE_NT_HEADERS peH;PIMAGE_SECTION_HEADERS peSecH;void *Ptr;unsigned long peSz;if (AlignPEToMem(ABuffer, Len, peH, peSecH, Ptr, peSz)){res = AttachPE(CmdParam, peH, peSecH, Ptr, peSz, *ProcessId);VirtualFree(Ptr, peSz, MEM_DECOMMIT);}return res;
}// 初始化
class CInit
{
public:CInit(){MyVirtualAllocEx = (pfVirtualAllocEx)GetProcAddress(GetModuleHandle("Kernel32.dll"), "VirtualAllocEx");}
}Init;int APIENTRY WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nCmdShow)
{HANDLE hFile = NULL;hFile = CreateFile("c:\\111.exe", GENERIC_ALL, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL);if (hFile == INVALID_HANDLE_VALUE)return -1;::SetFilePointer(hFile, 0, NULL, FILE_BEGIN);DWORD dwFileSize = ::GetFileSize(hFile, NULL);LPBYTE pBuf = new BYTE[dwFileSize];memset(pBuf, 0, dwFileSize);DWORD dwNumberOfBytesRead = 0;::ReadFile(hFile, pBuf, dwFileSize, &dwNumberOfBytesRead, NULL);::CloseHandle(hFile);unsigned long ulProcessId = 0;MemExecute(pBuf, dwFileSize, "", &ulProcessId);delete[] pBuf;return 0;
}