From: dork@gmx.at
Date: Tue Dec 05 2006 - 20:18:55 EST
hi,
maybe I'm wrong, but executable packing software like upx, aspack, pklite and
others are doing the same: decompress the binary to memory and run it from
there. That's why one needs to dump these packed executables from memory
before being able to do further tests on the "real" file.
But these programs have the original executable at the time it's packed, so
they can apply changes to PE, ELF,.. headers and precompute relocation
tables - things you'd need to do at runtime when it's an untouched executable
in memory.
You can find the upx sources at http://upx.sourceforge.net/ - featuring some
rare but interesting inline comments.
On Monday 04 December 2006 00:26, Jeroen wrote:
> Hi there,
>
> I want to load an EXE file directly from memory, without writing it to disk
> first. Are there some good tutorials on the web about this? Or other
> interesting links/tips/hints?
>
> Thanks,
>
>
> Jeroen
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:57:25 EDT