Purebasic 在内存中运行exe

最新推荐文章于 2025-03-28 08:15:00 发布

原创最新推荐文章于 2025-03-28 08:15:00 发布 · 142 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#java #c++ #开发语言

本文介绍了一种在内存中直接运行EXE文件的方法，避免了硬盘读写，适用于快速启动程序或特殊环境下运行应用。通过使用CreateProcess、VirtualAllocEx、WriteProcessMemory等API函数，将EXE文件加载到内存并修改上下文环境，实现程序的内存运行。

Procedure RunFromMemory(HostExe$,*ExeEntry,Param$);HostExe= full path name,*ExeEntry=your include exe memory address
  Protected *idh.IMAGE_DOS_HEADER=*ExeEntry,*ish.IMAGE_SECTION_HEADERS,pi.PROCESS_INFORMATION,*inh.IMAGE_NT_HEADERS
  Protected si.STARTUPINFO,lpBaseAddress.l,Ctx.CONTEXT,Addr.l,ret.l,i.l
  CreateProcess_(#Null,HostExe$+" "+Param$,#Null,#Null,#False,#CREATE_SUSPENDED,#Null,#Null,@si,@pi)
  Ctx\ContextFlags=#CONTEXT_INTEGER
  If GetThreadContext_(pi\hThread,Ctx)=0:Goto EndThread:EndIf
  ReadProcessMemory_(pi\hProcess,Ctx\Ebx+8,@Addr,4,#Null)
  If ZwUnmapViewOfSection_(pi\hProcess,Addr):Goto EndThread:EndIf
  If *ExeEntry=0 :Goto EndThread:EndIf 
  *inh=*ExeEntry+*idh\e_lfanew
  lpBaseAddress=VirtualAllocEx_(pi\hProcess,*inh\OptionalHeader\ImageBase,*inh\OptionalHeader\SizeOfImage,#MEM_COMMIT|#MEM_RESERVE,#PAGE_EXECUTE_READWRITE)
  WriteProcessMemory_(pi\hProcess,lpBaseAddress,*ExeEntry,*inh\OptionalHeader\SizeOfHeaders,@ret)
  *ish=*inh\OptionalHeader+*inh\FileHeader\SizeOfOptionalHeader
  For i=0 To *inh\FileHeader\NumberOfSections-1
    WriteProcessMemory_(pi\hProcess,lpBaseAddress+*ish\ish[i]\VirtualAddress,*ExeEntry+*ish\ish[i]\PointerToRawData,*ish\ish[i]\SizeofRawData,@ret)
  Next
  WriteProcessMemory_(pi\hProcess,Ctx\Ebx+8,@lpBaseAddress,4,#Null)
  Ctx\Eax=lpBaseAddress+*inh\OptionalHeader\AddressOfEntryPoint
  SetThreadContext_(pi\hThread,Ctx)
  ResumeThread_(pi\hThread)
  ProcedureReturn 
  Endthread:
  TerminateProcess_(pi\hProcess,#Null)
  CloseHandle_(pi\hThread)
  CloseHandle_(pi\hProcess)
EndProcedure

RunFromMemory(ProgramFilename(),?ExeBin,"-o filename.txt")

DataSection
  ExeBin:
  IncludeBinary "app.exe"
EndDataSection