Penetration Testing mailing list archives
Re: Loading EXE files directly from memory?
From: dork () gmx at
Date: Wed, 6 Dec 2006 02:18:55 +0100
hi, maybe I'm wrong, but executable packing software like upx, aspack, pklite and others are doing the same: decompress the binary to memory and run it from there. That's why one needs to dump these packed executables from memory before being able to do further tests on the "real" file. But these programs have the original executable at the time it's packed, so they can apply changes to PE, ELF,.. headers and precompute relocation tables - things you'd need to do at runtime when it's an untouched executable in memory. You can find the upx sources at http://upx.sourceforge.net/ - featuring some rare but interesting inline comments. On Monday 04 December 2006 00:26, Jeroen wrote:
Hi there, I want to load an EXE file directly from memory, without writing it to disk first. Are there some good tutorials on the web about this? Or other interesting links/tips/hints? Thanks, Jeroen
------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW ------------------------------------------------------------------------
Current thread:
- Loading EXE files directly from memory? Jeroen (Dec 03)
- Re: Loading EXE files directly from memory? Peter Parker (Dec 04)
- RE: Loading EXE files directly from memory? Omar Herrera (Dec 05)
- Re: Loading EXE files directly from memory? Justin Ferguson (Dec 05)
- Re: Loading EXE files directly from memory? Krugger (Dec 07)
- Re: Loading EXE files directly from memory? Esteban Lucena (Dec 05)
- Re: Loading EXE files directly from memory? dork (Dec 07)
- RE: Loading EXE files directly from memory? Marc Doudiet (Dec 17)
- Re: Loading EXE files directly from memory? Peter Parker (Dec 04)