Writing to program memory in hex editor and reading programmatically

Question

Well I have .exe application and some other file. What I want to do is to write this other file to the end of .exe file. .exe file should find the address of this file in its memory, read it from there and do some stuff.

I was able to get to the address of the file I wrote to the memory before but when I try reading from there I get access denied exception. How can I read from there?

Basically I just want to have one self-unpacking PE file. Yes, I know, I can just make self-extracting archive but that's not what I want because I need both .exe and .dll but self-extracting archive can be only .exe so it looks the only way is to make my application self-extracting itself. Here's the code:

int main(void)
{
    HMODULE hBegin = GetModuleHandle(NULL);

    PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)hBegin;
    PIMAGE_NT_HEADERS ntHeaders = (PIMAGE_NT_HEADERS)((PBYTE)hBegin + dosHeader->e_lfanew);
    PIMAGE_SECTION_HEADER pSectionTable = (PIMAGE_SECTION_HEADER)(ntHeaders + 1);


    // get size of each section
    DWORD dwSize = 0;

    for(int i = 0; i < ntHeaders->FileHeader.NumberOfSections; i++)
    {
        dwSize += pSectionTable[i].SizeOfRawData;
    }

    //get size of PE headers
    dwSize += ntHeaders->OptionalHeader.SizeOfHeaders;

    WCHAR lpszSfxPath[MAX_PATH];
        GetModuleFileNameW(NULL, lpszSfxPath, MAX_PATH);
    HANDLE hFile = CreateFileW(lpszSfxPath,
            GENERIC_READ,
            FILE_SHARE_READ,
            NULL,
            OPEN_EXISTING,
            FILE_ATTRIBUTE_NORMAL,
            NULL);
    SetFilePointer(hFile, dwSize, NULL, FILE_BEGIN);
    BYTE BUF[10];
    if(!ReadFile(hFile,BUF,sizeof(BYTE),NULL,NULL))
        printf("FAIL!\n");

    printf("HELLO WORLD\n");
    getchar();
    return 0;
}

After calling SetFilePointer file pointer points just after the end of file where my packed file is stored, but I'm not able to read from ther

Adrian McCarthy · Accepted Answer · 2012-11-12 17:35:59Z

5

Microsoft's PE executable binary files contain a separate section for resources which can be placed within the file - as in, resources are used to ship data within the executable files. This is where you most probably want to place your data in.

Take a look: http://www.devsource.com/c/a/Architecture/Resources-From-PE-I/

edited Nov 12, 2012 at 17:35

Adrian McCarthy

49.8k16 gold badges136 silver badges194 bronze badges

answered Nov 12, 2012 at 14:25

zxcdw

1,6691 gold badge11 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Some programmer dude · Accepted Answer · 2012-11-12 15:26:46Z

1

A possible other solution would be to store a header structure last in the file, containing offset into the file where the data starts, and the length of the data. Then your program can easily seek to the end of the file (minus the size of the header), and read the position and length of the data.

What you do is take your executable file, write it to a second file, possibly write padding, write the data, write possible more padding, and finally write the length of the data and the position of the data in the file.

The file will look (on disk) something like:

+-------------+
| Executable  |
| Program     |
+-------------+
| Padding     |
+-------------+
| Data        |
+-------------+
| Padding     |
+-------------+
| Data length |
| Data pos.   |
+-------------+

Now the executable can open the file as a regular file, read-only. Seek to the end minus the size of the data length and data position fields (typically sizeof(DWORD) (times two)). Read the two fields for length and position. Now you can seek to the actual position of where the data is (data pos.) and read data length bytes to read the actual data.

edited Nov 12, 2012 at 15:26

answered Nov 12, 2012 at 14:21

Some programmer dude

411k36 gold badges420 silver badges655 bronze badges

4 Comments

spandei Over a year ago

The problem is I can't actually read from the file anything but "MZ" using ReadFile function

spandei Over a year ago

That's good but it looks like I still hasn't managed to explain how I want all this stuff to work. I want to create an executable file containing another file in itself so that it would be possible to run this exe with file in it and it would unpack this second file from the memory during the execution. What you're talking about is: to have exe and file, exe during the execution uses this file to create another exe with the file injected in it. But I need single self-packing exe.

Harry Johnston Over a year ago

You mean you want the executable to modify itself? That's not possible, but it also isn't what your original question asked. Please clarify what your actual problem is: what exactly do you mean when you say you can't read anything but MZ from the file? What goes wrong when you try?

spandei Over a year ago

Well I solved the problem using resource file. Another possible solution is using bin2h utility to get .h file which stores binary file's binary code in the array of unsigned chars. The just simply create file x.exe or x.dll and write this array to it. Anyway appreciate your help:)

Collectives™ on Stack Overflow

Writing to program memory in hex editor and reading programmatically

2 Answers 2

Comments

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related