0

I'm working on different PE Injection technique. I want inject PE file into virtual memory of current executable. After that, I want execute injected PE file, I wrote inject code but my method is not working. Dos header and NT header parse correct, I write correctly sections and create new thread on the entrypoint of the .text section, but thread not working. What is the problem here?

#include <iostream>
#include <windows.h>

int main()
{
    DWORD* ImageBase;
    void* pImageBase;
    IMAGE_NT_HEADERS* NTHeader;
    IMAGE_DOS_HEADER* DOSHeader;
    IMAGE_NT_HEADERS* mem_NTHeader;
    IMAGE_DOS_HEADER* mem_DOSHeader;
    IMAGE_SECTION_HEADER* SecHeader;
    unsigned char memory_pe[] = { 0x4D, 0x5A, 0x90, 0x00, 0x03, 0x00, ........} // This is binary of PE file.
    DOSHeader = PIMAGE_DOS_HEADER(memory_pe);
    NTHeader = PIMAGE_NT_HEADERS(DWORD(memory_pe) + DOSHeader->e_lfanew);
    pImageBase = VirtualAlloc(NULL, NTHeader->OptionalHeader.SizeOfImage, 0x3000, PAGE_EXECUTE_READWRITE);
    memcpy(pImageBase, memory_pe, NTHeader->OptionalHeader.SizeOfHeaders);
    for (int i = 0; i < NTHeader->FileHeader.NumberOfSections; i++) {
        SecHeader = (PIMAGE_SECTION_HEADER)(DWORD(memory_pe) + DOSHeader->e_lfanew + 248 + (i * 40));
        memcpy(LPVOID(DWORD(pImageBase) + SecHeader->VirtualAddress), LPVOID(DWORD(memory_pe) + SecHeader->PointerToRawData), SecHeader->SizeOfRawData);
    }
    mem_DOSHeader = PIMAGE_DOS_HEADER(pImageBase);
    mem_NTHeader = PIMAGE_NT_HEADERS(DWORD(pImageBase) + mem_DOSHeader->e_lfanew);
    CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)(DWORD(pImageBase) + mem_NTHeader->OptionalHeader.BaseOfCode), NULL, 0, NULL);
    return 0;
}
Improve this question
2
  • is BaseOfCode set correctly? It's an optional field and might not contain any meaningful value. The proper starting point is the AddressOfEntryPoint field. – peter ferrie Mar 1 at 5:46
  • I tried put AddressOfEntryPoint instead BaseOfCode but, issue still continues. – Crazy Programmer Mar 1 at 9:54
0

Loading and successfully running code associated with an arbitrary PE may require some additional steps e.g. relocation. Consider converting the EXE into a DLL like this or this so that you can use Windows APIs to load the code for you.

Improve this answer
3
  • Thank you for supply valuable sources to me. I will try and reply to you. – Crazy Programmer Feb 28 at 22:02
  • I reviewed the sources you posted but I don't mean I want translate exe to DLL. – Crazy Programmer Feb 28 at 23:53
  • In that case you may need to debug the code to see where it is not working appropriately. Without the compiled EXE, I can only guess what is happening. – P. Private Mar 1 at 1:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.