欢迎来到天天文库
浏览记录
ID:34737079
大小:60.38 KB
页数:12页
时间:2019-03-10
《从内存中加载并启动一个exe》由会员上传分享,免费在线阅读,更多相关内容在工程资料-天天文库。
1、从内存中加载并启动一个exe(C++版)原理:1.把你的程序读要内存2.以CREATE_SUSPENDED模式CreateProcess打开svchost.exe3.修改svchost.exe页面的属性,然后把要运行的那个程序的内容拷贝到svchost.exe页面4.然后再运行实质想当于是披着/svchost.exe进程的相关信息/这张皮,而皮里面的肉都被改了原文来自哪里忘记了,。呵呵//#include#include#include//
2、#include"ntpsapi.h"structPEHeader{ unsignedlongsignature; unsignedshortmachine; unsignedshortnumSections; unsignedlongtimeDateStamp; unsignedlongpointerToSymbolTable; unsignedlongnumOfSymbols; unsignedshortsizeOfOptionHeader; unsignedshortcharact
3、eristics;};typedefstructPEHeaderPE_Header;structPEExtHeader{ unsignedshortmagic; unsignedcharmajorLinkerVersion; unsignedcharminorLinkerVersion; unsignedlongsizeOfCode; unsignedlongsizeOfInitializedData; unsignedlongsizeOfUninitializedData; unsign
4、edlongaddressOfEntryPoint; unsignedlongbaseOfCode; unsignedlongbaseOfData; unsignedlongimageBase; unsignedlongsectionAlignment; unsignedlongfileAlignment; unsignedshortmajorOSVersion; unsignedshortminorOSVersion; unsignedshortmajorImageVersion;
5、unsignedshortminorImageVersion; unsignedshortmajorSubsystemVersion; unsignedshortminorSubsystemVersion; unsignedlongreserved1; unsignedlongsizeOfImage; unsignedlongsizeOfHeaders; unsignedlongchecksum; unsignedshortsubsystem; unsignedshortDLLChara
6、cteristics; unsignedlongsizeOfStackReserve; unsignedlongsizeOfStackCommit; unsignedlongsizeOfHeapReserve; unsignedlongsizeOfHeapCommit; unsignedlongloaderFlags; unsignedlongnumberOfRVAAndSizes; unsignedlongexportTableAddress; unsignedlongexportTa
7、bleSize; unsignedlongimportTableAddress; unsignedlongimportTableSize; unsignedlongresourceTableAddress; unsignedlongresourceTableSize; unsignedlongexceptionTableAddress; unsignedlongexceptionTableSize; unsignedlongcertFilePointer; unsignedlongcer
8、tTableSize; unsignedlongrelocationTableAddress; unsignedlongrelocationTableSize; unsignedlongdebugDataAddress; unsignedlongdebugDataSize; unsignedlongarchDataAddress; unsignedlongarchDataSize; unsignedlongglobalPtrA
此文档下载收益归作者所有