Run executable from Memory

[jalojavier]

Hello,

I am developing a project in C# and i have some troubles with the next:

I have a byte[] that contains a .exe readed/loaded from a FileStream. I want to execute this executable loaded in the byte[] from memory (not pushing it in a .exe and calling it). ¿It is possible?

Someone told me about System.Reflection.Emit and I read something about Assembly.Load(byte[] data), when 'data' is a COFF image of the executable file, but, i only have a "normal" byte[] that contains the bytes of the exe readed from FileStream..

¿Anyone can help me?

Thanks.

 

[cappmgr]

This should get you started. It works and is a proof of concept.

using System;
class HelloWorld
{
    static void Main(string[] args)
    {
       Console.WriteLine("Hello World");
    }
}

using System;
using System.Collections.Generic;
using System.Text;
using System.IO;
using System.Reflection;

class RunExeFromMemory
{
    static void Main(string[] args)
    {
        // read the bytes from the application exe file
        string exeToRun = "HelloWorld.exe";
        FileStream fs = new FileStream(exeToRun, FileMode.Open);
        BinaryReader br = new BinaryReader(fs);
        byte[] bin = br.ReadBytes(Convert.ToInt32(fs.Length));
        fs.Close();
        br.Close();
        // load the bytes into Assembly
        Assembly a = Assembly.Load(bin);
        // search for the Entry Point
        MethodInfo method = a.EntryPoint;
        // create an istance of the Main method
        object o = a.CreateInstance(method.Name);
        // invoke the application starting point
        try
        {
          // if the method is static as it is in HelloWorld.exe you can use null
          method.Invoke(null, new object[]{args});
          // if not static you'll need the object
          //method.Invoke(o, new object[]{args});
        }
        catch (Exception ex)
        {
          Console.WriteLine(ex.Message);
        }
    }
}

Marty

 

[jalojavier]

Hello,

Thanks for the code. I was searching a lot and i found this same code but it has a little problem. Only work with .NET PE's.. ¿Exists some alternative to NOT .NET PE files?

Thanks

 

[cappmgr]

Can you post the link. Also everything I read said it can be used for other exe's.

Marty

 

[jalojavier]

I read from:

http://www.codeproject.com/useritems/LoadExeIntoAssembly.asp

I try with not .NET exe's and not works. It throws an BadFormatImageException.

 

[cappmgr]

Thats one of the sites I read but kept on getting an exception with
// invoke the application starting point
method.Invoke(o, null);

This is interesting I'll keep trying.
What is the language your exe is written in.

Marty

 

[jalojavier]

I want to make that my application can work with all kind of executables, independent of the language of was written.

I'm making my tests with not .NET executables with calc.exe that i think is written in.. c++ ?

 

[chiph]

Maybe if we knew more about why you want to do this?

Chip H.


____________________________________________________________________
If you want to get the best response to a question, please read FAQ222-2244 first

 

[jalojavier]

Hello,

I am making some tests in C# and the problem exposed is in the next context:

I have a executable file developed in C#, that will append to itself the code or other executable file (like a virus infection).

The problem is that when i try to execute the (app+appended exe), i can extract the appended exe and execute it with Assembly.Load in case of .NET executables, but, in any other executable with this method seems to not be possible.

This problem is similar to EXE's generated by Winzip or similar when you tells the program that generate an EXE file and execute the file that was "zipped" in (in resume, a loader+other executable file).

 

[chiph]

You could write the attached bytes to the user's temp folder, and name the file with a .exe extension, and then run it with the Process class like any other.

Chip H.


____________________________________________________________________
If you want to get the best response to a question, please read FAQ222-2244 first

 

[jalojavier]

Yes, i know that i have this option, and i try with it an works perfectly, but i prefer to run the exe from memory instead of running with auxiliar files, because if the main process or exe ends before the exe that i extract to a temp file i couldn't delete it and i don't want to left remainders.

 

[chiph]

Don't think I can help you, then.

Sorry.
Chip H.


____________________________________________________________________
If you want to get the best response to a question, please read FAQ222-2244 first

 

[jalojavier]

Ok, don't worry. Thanks any way.

 

[Nemhain]

See this write-up:

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2mempr.mspx

 

[jalojavier]

Ouch! I understand. Thanks for the link

 

[JurkMonkey]

There goes your virus plan huh?

 

[jalojavier]

Really goes my "restlessnesses".. i was planning other uses but.. in fact, this can be one of this uses.. >)