-1

I'm working on different PE Injection technique. I want to inject PE file into virtual memory of the current executable. After that, I want to execute the injected PE file, I wrote an injection code, but my method is not working.

DOS header and NT header parse correctly, I write correctly sections and create new thread on the entrypoint of the .text section, but the thread is not working. What is the problem here?

#include <iostream>
#include <windows.h>

int main()
{
    DWORD* ImageBase;
    void* pImageBase;
    IMAGE_NT_HEADERS* NTHeader;
    IMAGE_DOS_HEADER* DOSHeader;
    IMAGE_NT_HEADERS* mem_NTHeader;
    IMAGE_DOS_HEADER* mem_DOSHeader;
    IMAGE_SECTION_HEADER* SecHeader;
    unsigned char memory_pe[] = { 0x4D, 0x5A, 0x90, 0x00, 0x03, 0x00, ........} // This is binary of PE file.
    DOSHeader = PIMAGE_DOS_HEADER(memory_pe);
    NTHeader = PIMAGE_NT_HEADERS(DWORD(memory_pe) + DOSHeader->e_lfanew);
    pImageBase = VirtualAlloc(NULL, NTHeader->OptionalHeader.SizeOfImage, 0x3000, PAGE_EXECUTE_READWRITE);
    memcpy(pImageBase, memory_pe, NTHeader->OptionalHeader.SizeOfHeaders);
    for (int i = 0; i < NTHeader->FileHeader.NumberOfSections; i++) {
        SecHeader = (PIMAGE_SECTION_HEADER)(DWORD(memory_pe) + DOSHeader->e_lfanew + 248 + (i * 40));
        memcpy(LPVOID(DWORD(pImageBase) + SecHeader->VirtualAddress), LPVOID(DWORD(memory_pe) + SecHeader->PointerToRawData), SecHeader->SizeOfRawData);
    }
    mem_DOSHeader = PIMAGE_DOS_HEADER(pImageBase);
    mem_NTHeader = PIMAGE_NT_HEADERS(DWORD(pImageBase) + mem_DOSHeader->e_lfanew);
    CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)(DWORD(pImageBase) + mem_NTHeader->OptionalHeader.BaseOfCode), NULL, 0, NULL);
    return 0;
}
2
  • is BaseOfCode set correctly? It's an optional field and might not contain any meaningful value. The proper starting point is the AddressOfEntryPoint field. Mar 1 at 5:46
  • I tried put AddressOfEntryPoint instead BaseOfCode but, issue still continues. Mar 1 at 9:54
1

Loading and successfully running code associated with an arbitrary PE may require some additional steps e.g. relocation. Consider converting the EXE into a DLL like this or this so that you can use Windows APIs to load the code for you.

3
  • Thank you for supply valuable sources to me. I will try and reply to you. Feb 28 at 22:02
  • I reviewed the sources you posted but I don't mean I want translate exe to DLL. Feb 28 at 23:53
  • 1
    In that case you may need to debug the code to see where it is not working appropriately. Without the compiled EXE, I can only guess what is happening.
    – P. Private
    Mar 1 at 1:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.