各位大哥,在Delphi里面如何执和同一块内存区中的Exe文件 ( 积分: 100 )

  • 主题发起人 主题发起人 meigreat
  • 开始时间 开始时间
M

meigreat

Unregistered / Unconfirmed
GUEST, unregistred user!
在Delphi里面
FMemoStream里面是一个Exe程序,如何在主程序里面不用把这个内存区存为文件,而直接转入执行呢??
请各位兄弟姐妹知道的帮忙呀!!![:)][:)][:)][:)][:)]
 
就像加壳的程序一样把其它程序加在我的代码里面,然后按我的调用方式调用我的代码里的Exe
 
我终于找到了
[:)][:)][:)] 呵呵,看来分只有留给我自已了
 
你自己的EXE定位在高位免得和要执行的EXE装入位置冲突.
然后解析PE文件,修复重定位.按导入表载入DLL.修正导入函数.
跳到EXE的入口处执行.
 
终于见到高人啦,现在我找到的这段代码是这样的。

{
EXE Memory Unit Two For NT,2K,XP,2K3,LH By Anskya
Email:Anskya@Gmail.com
Web:Www.Anskya.Net
Date:04.08.2005
Thank:Aphex

procedure MemoryRunExe(FileMemory: Pointer);
[
This program creates undetected executables that only run
on Windows NT, 2000, XP, 2003 and LongHorn. ҩƷ
]
}
Unit MemoryRunUnitTwo;

interface

{$IMAGEBASE $10000000}

uses
Windows;

type
TSections = array [0..0] of TImageSectionHeader;

procedure MemoryRunExe(FileMemory: Pointer);

implementation

function GetAlignedSize(Size: dword; Alignment: dword): dword;
begin
if ((Size mod Alignment) = 0) then
begin
Result := Size;
end
else
begin
Result := ((Size div Alignment) + 1) * Alignment;
end;
end;

function ImageSize(Image: pointer): dword;
var
Alignment: dword;
ImageNtHeaders: PImageNtHeaders;
PSections: ^TSections;
SectionLoop: dword;
begin
ImageNtHeaders := pointer(dword(dword(Image)) + dword(PImageDosHeader(Image)._lfanew));
Alignment := ImageNtHeaders.OptionalHeader.SectionAlignment;
if ((ImageNtHeaders.OptionalHeader.SizeOfHeaders mod Alignment) = 0) then
begin
Result := ImageNtHeaders.OptionalHeader.SizeOfHeaders;
end
else
begin
Result := ((ImageNtHeaders.OptionalHeader.SizeOfHeaders div Alignment) + 1) * Alignment;
end;
PSections := pointer(pchar(@(ImageNtHeaders.OptionalHeader)) + ImageNtHeaders.FileHeader.SizeOfOptionalHeader);
for SectionLoop := 0 to ImageNtHeaders.FileHeader.NumberOfSections - 1 do
begin
if PSections[SectionLoop].Misc.VirtualSize <> 0 then
begin
if ((PSections[SectionLoop].Misc.VirtualSize mod Alignment) = 0) then
begin
Result := Result + PSections[SectionLoop].Misc.VirtualSize;
end
else
begin
Result := Result + (((PSections[SectionLoop].Misc.VirtualSize div Alignment) + 1) * Alignment);
end;
end;
end;
end;

procedure MemoryRunExe(FileMemory: Pointer);
var
BaseAddress, Bytes, HeaderSize, InjectSize, SectionLoop, SectionSize: dword;
Context: TContext;
FileData: pointer;
ImageNtHeaders: PImageNtHeaders;
InjectMemory: pointer;
ProcInfo: TProcessInformation;
PSections: ^TSections;
StartInfo: TStartupInfo;
begin
ImageNtHeaders := pointer(dword(dword(FileMemory)) + dword(PImageDosHeader(FileMemory)._lfanew));
InjectSize := ImageSize(FileMemory);
GetMem(InjectMemory, InjectSize);
try
FileData := InjectMemory;
HeaderSize := ImageNtHeaders.OptionalHeader.SizeOfHeaders;
PSections := pointer(pchar(@(ImageNtHeaders.OptionalHeader)) + ImageNtHeaders.FileHeader.SizeOfOptionalHeader);
for SectionLoop := 0 to ImageNtHeaders.FileHeader.NumberOfSections - 1 do
begin
if PSections[SectionLoop].PointerToRawData < HeaderSize then HeaderSize := PSections[SectionLoop].PointerToRawData;
end;
CopyMemory(FileData, FileMemory, HeaderSize);
FileData := pointer(dword(FileData) + GetAlignedSize(ImageNtHeaders.OptionalHeader.SizeOfHeaders, ImageNtHeaders.OptionalHeader.SectionAlignment));
for SectionLoop := 0 to ImageNtHeaders.FileHeader.NumberOfSections - 1 do
begin
if PSections[SectionLoop].SizeOfRawData > 0 then
begin
SectionSize := PSections[SectionLoop].SizeOfRawData;
if SectionSize > PSections[SectionLoop].Misc.VirtualSize then SectionSize := PSections[SectionLoop].Misc.VirtualSize;
CopyMemory(FileData, pointer(dword(FileMemory) + PSections[SectionLoop].PointerToRawData), SectionSize);
FileData := pointer(dword(FileData) + GetAlignedSize(PSections[SectionLoop].Misc.VirtualSize, ImageNtHeaders.OptionalHeader.SectionAlignment));
end
else
begin
if PSections[SectionLoop].Misc.VirtualSize <> 0 then FileData := pointer(dword(FileData) + GetAlignedSize(PSections[SectionLoop].Misc.VirtualSize, ImageNtHeaders.OptionalHeader.SectionAlignment));
end;
end;
ZeroMemory(@StartInfo, SizeOf(StartupInfo));
ZeroMemory(@Context, SizeOf(TContext));
CreateProcess(nil, pchar(ParamStr(0)), nil, nil, False, CREATE_SUSPENDED, nil, nil, StartInfo, ProcInfo);
Context.ContextFlags := CONTEXT_FULL;
GetThreadContext(ProcInfo.hThread, Context);
ReadProcessMemory(ProcInfo.hProcess, pointer(Context.Ebx + 8), @BaseAddress, 4, Bytes);
VirtualAllocEx(ProcInfo.hProcess, pointer(ImageNtHeaders.OptionalHeader.ImageBase), InjectSize, MEM_RESERVE or MEM_COMMIT, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(ProcInfo.hProcess, pointer(ImageNtHeaders.OptionalHeader.ImageBase), InjectMemory, InjectSize, Bytes);
WriteProcessMemory(ProcInfo.hProcess, pointer(Context.Ebx + 8), @ImageNtHeaders.OptionalHeader.ImageBase, 4, Bytes);
Context.Eax := ImageNtHeaders.OptionalHeader.ImageBase + ImageNtHeaders.OptionalHeader.AddressOfEntryPoint;
SetThreadContext(ProcInfo.hThread, Context);
ResumeThread(ProcInfo.hThread);
finally
FreeMemory(InjectMemory);
end;
end;

end.
PE结构我没有接触多少, 大概是将程序本自的ImageBase 改为$10000000 然后建立一个空进程 ,欢迎大家一起讨论共同提高
 
你这段代码好象对压缩过的EXE不支持.
GOOGLE一下 PEUnit 这个关键词,能找到支持压缩的
 
上面那段代码是比较流行的.和我说的原理不太一样.
那段代码是创建一个新的进程,进程状态是暂停的,然后把进程中的代码填写成要执行的EXE的代码.修改主线程上下文对准执行代码.然后唤醒主线程.
这也是一个变通的方法.
 
PEUnit 很好,里面还带有比较详尽的说明
http://www.05112.com/Article/Print.asp?ArticleID=13875&Page=1
先看一下
 
大家用过D2007没有,我下了两天,终于下了一个,
procedure TForm1.函数;
var
结体实例:结构;
begin
结体实例.a:=12;
结体实例.函数内容:=100;
ShowMessage('Text'+IntToStr(结体实例.函数内容) );
end;

{ 类 }

constructor 类.create;
begin
内容:=10;
end;
上面的代码是不是觉得很爽,我昨天差兴奋到半夜, 看了D2007里增加的新语法,看来D2007进步不小,用Delphi的人这下有福了
 
结了,,[:)][:)][:)][:)][:)] 谢谢参与
 

Similar threads

S
回复
0
查看
3K
SUNSTONE的Delphi笔记
S
S
回复
0
查看
2K
SUNSTONE的Delphi笔记
S
D
回复
0
查看
2K
DelphiTeacher的专栏
D
后退
顶部