从内存中加载并启动一个exe

《从内存中加载并启动一个exe》由会员上传分享，免费在线阅读，更多相关内容在工程资料-天天文库。

1、从内存中加载并启动一个exe(C++版)原理:1.把你的程序读要内存2.以CREATE_SUSPENDED模式CreateProcess打开svchost.exe3.修改svchost.exe页面的属性，然后把要运行的那个程序的内容拷贝到svchost.exe页面4.然后再运行实质想当于是披着/svchost.exe进程的相关信息/这张皮，而皮里面的肉都被改了原文来自哪里忘记了，。呵呵//#include#include#include//

2、#include"ntpsapi.h"structPEHeader{  unsignedlongsignature;  unsignedshortmachine;  unsignedshortnumSections;  unsignedlongtimeDateStamp;  unsignedlongpointerToSymbolTable;  unsignedlongnumOfSymbols;  unsignedshortsizeOfOptionHeader;  unsignedshortcharact

3、eristics;};typedefstructPEHeaderPE_Header;structPEExtHeader{  unsignedshortmagic;  unsignedcharmajorLinkerVersion;  unsignedcharminorLinkerVersion;  unsignedlongsizeOfCode;  unsignedlongsizeOfInitializedData;  unsignedlongsizeOfUninitializedData;  unsign

4、edlongaddressOfEntryPoint;  unsignedlongbaseOfCode;  unsignedlongbaseOfData;  unsignedlongimageBase;  unsignedlongsectionAlignment;  unsignedlongfileAlignment;  unsignedshortmajorOSVersion;  unsignedshortminorOSVersion;  unsignedshortmajorImageVersion;  

5、unsignedshortminorImageVersion;  unsignedshortmajorSubsystemVersion;  unsignedshortminorSubsystemVersion;  unsignedlongreserved1;  unsignedlongsizeOfImage;  unsignedlongsizeOfHeaders;  unsignedlongchecksum;  unsignedshortsubsystem;  unsignedshortDLLChara

6、cteristics;  unsignedlongsizeOfStackReserve;  unsignedlongsizeOfStackCommit;  unsignedlongsizeOfHeapReserve;  unsignedlongsizeOfHeapCommit;  unsignedlongloaderFlags;  unsignedlongnumberOfRVAAndSizes;  unsignedlongexportTableAddress;  unsignedlongexportTa

7、bleSize;  unsignedlongimportTableAddress;  unsignedlongimportTableSize;  unsignedlongresourceTableAddress;  unsignedlongresourceTableSize;  unsignedlongexceptionTableAddress;  unsignedlongexceptionTableSize;  unsignedlongcertFilePointer;  unsignedlongcer

8、tTableSize;  unsignedlongrelocationTableAddress;  unsignedlongrelocationTableSize;  unsignedlongdebugDataAddress;  unsignedlongdebugDataSize;  unsignedlongarchDataAddress;  unsignedlongarchDataSize;  unsignedlongglobalPtrA