Re: Loading EXE files directly from memory?

[dork () gmx at]

hi,

maybe I'm wrong, but executable packing software like upx, aspack, pklite and 
others are doing the same: decompress the binary to memory and run it from 
there. That's why one needs to dump these packed executables from memory 
before being able to do further tests on the "real" file.

But these programs have the original executable at the time it's packed, so 
they can apply changes to PE, ELF,.. headers and precompute relocation 
tables - things you'd need to do at runtime when it's an untouched executable 
in memory.

You can find the upx sources at http://upx.sourceforge.net/ - featuring some 
rare but interesting inline comments.


On Monday 04 December 2006 00:26, Jeroen wrote:
> Hi there,
>
> I want to load an EXE file directly from memory, without writing it to disk
> first. Are there some good tutorials on the web about this? Or other
> interesting links/tips/hints?
>
> Thanks,
>
>
> Jeroen

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------