Run Exe From Memory (32/64 bit)

[Watson]

Hello,

Same as SunSunshine. I used a similar code and the injection doesn't work on X64 :-(

(The goal is to inject a 32bit exe in the memory of a X64 platform)

@Watson :

Can you please explain me why this instruction "Global $baseexe = @WindowsDir & "\explorer.exe" could solve the problem ?

I don't understand.

Thanks.

Mag.

Your problem is different!

The variable $baseexe was not declared in the code of sunsunshine. It follows that the problem was due to the variable

[eimhym]

@IchBistTod

Thanks for implementing this in AutoIt

A bit addition to run exe with parameters.

change

Func _RunExeFromMemory($bBinaryImage, $iCompressed = 0, $test = 0)

with

Func _RunExeFromMemory($bBinaryImage, $sParameters = 0, $iCompressed = 0, $test = 0)

and

; Create new process
$aCall = DllCall("kernel32.dll", "int", "CreateProcessW", _
         "wstr", $BaseExe, _ ; try something else too (now only range plays, giving us a space)
         "ptr", 0, _

with

; Create new process
If $sParameters Then $sParameters = $BaseExe & " " & $sParameters
$aCall = DllCall("kernel32.dll", "int", "CreateProcessW", _
         "wstr", $BaseExe, _ ; try something else too (now only range plays, giving us a space)
         "wstr", $sParameters, _

So the function can be called with

$file = FileOpen(@WindowsDir & "\notepad.exe", 16)
If $file > -1 Then
$buffer = FileRead($file)
FileClose($file)
_RunExeFromMemory($buffer, '"' & @AppDataDir & '\desktop.ini"')
EndIf

which will run notepad with desktop.ini loaded, and no trace of notepad.exe in process list.

[legend]

not sure how to call this, not working for me

[guinness]

You don't know how to use it so you conclude it doesn't work?

[water]

When will people understand that "not working for me" isn't enough to let us help them?

Show error messages, return values of the called function, the values of @error and @extended etc.

Show the code you use and the debugging steps you have already taken.

Do we ask for too much?

[Jos]

When will people understand that "not working for me" isn't enough to let us help them?

Show error messages, return values of the called function, the values of @error and @extended etc.

Show the code you use and the debugging steps you have already taken.

Do we ask for too much?

This is simply an indication you are around for long time and getting closer to the final stage at the forum which will be:

When you read any post like that you simply move on to the next without even bothering.

Edited March 17, 2013 by Jos
typos

[water]

If I'm in the mood I post how to debug and hope the user will learn and better describe/document his problem next time.

If I'm not, I just whine a bit

[BrewManNH]

If I'm in the mood I post how to debug and hope the user will learn and better describe/document his problem next time.

If I'm not, I just whine a bit

I put a huge link in my signature that links to a document written in 19 languages that show people how to post a question on a support forum. Unfortunately, no one uses it because they'd rather that we all be mind readers than to make the effort to help themself.

[water]

A great source of information but a long read.

I'm sure people who are too lazy to use Google are too lazy to read this as well - unfortunately

[Leo1906]

This doesn't seem to work on Windows 10 x64 .. can somebody confirm this? Is there a fix for this OS?

When running the script nothing happens. I tried executing notepad and a compiled exe which will just execute a MsgBox ..
Also tried the changes eimhym suggests ..

Anybody here who can help?

 

€: just found trancexx script here and it works perfectly: 

 

Edited September 5, 2016 by Leo1906