RunPe برای فایهای اجرایی 64 بیتی

[Nima NT]

با سلام
من با کد زیر تلاش کردم فایلهای 64 بیتی رو در حافظه اجرا کنم ولی موفق نشدم
دوستان میتونن کمک کنن که مشکل از کجاست ؟
کد برنامه :
{$APPTYPE CONSOLE}

{$R *.res}

uses
SysUtils,
Windows,
Classes;

type
TSections = array [0..0] of TImageSectionHeader;


//{$IMAGEBASE $10000000}

function GetAlignedSize(Size: dword; Alignment: dword): dword;
begin
if ((Size mod Alignment) = 0) then
Result := Size
else
Result := ((Size div Alignment) + 1) * Alignment;
end;

function ImageSize(Image: pointer): DWORD64;
var
Alignment: DWORD64;
ImageNtHeaders: PImageNtHeaders64;
PSections: ^TSections;
SectionLoop: dword;
begin
ImageNtHeaders := pointer(DWORD64(DWORD64(Image)) + DWORD64(PImageDosHeader(Image)._lfanew));
Alignment := ImageNtHeaders.OptionalHeader.SectionAlignment;
if ((ImageNtHeaders.OptionalHeader.SizeOfHeaders mod Alignment) = 0) then
begin
Result := ImageNtHeaders.OptionalHeader.SizeOfHeaders;
end
else
begin
Result := ((ImageNtHeaders.OptionalHeader.SizeOfHeaders div Alignment) + 1) * Alignment;
end;
PSections := pointer(pchar(@(ImageNtHeaders.OptionalHeader)) + ImageNtHeaders.FileHeader.SizeOfOptionalHeader);
for SectionLoop := 0 to ImageNtHeaders.FileHeader.NumberOfSections - 1 do
begin
if PSections[SectionLoop].Misc.VirtualSize <> 0 then
begin
if ((PSections[SectionLoop].Misc.VirtualSize mod Alignment) = 0) then
begin
Result := Result + PSections[SectionLoop].Misc.VirtualSize;
end
else
begin
Result := Result + (((PSections[SectionLoop].Misc.VirtualSize div Alignment) + 1) * Alignment);
end;
end;
end;
end;

procedure CreateProcessEx(FileMemory: pointer);
var
BaseAddress, HeaderSize, InjectSize, SectionSize: DWORD64;
SectionLoop :DWORD;
Bytes:DWORD_PTR;
Context: TContext;
FileData: pointer;
ImageNtHeaders: PImageNtHeaders64;
InjectMemory: pointer;
ProcInfo: TProcessInformation;
PSections: ^TSections;
StartInfo: TStartupInfo;
begin
ImageNtHeaders := pointer(DWORD64(DWORD64(FileMemory)) + DWORD64(PImageDosHeader(FileMemory)._lfanew));
InjectSize := ImageSize(FileMemory);
GetMem(InjectMemory, InjectSize);
Context.ContextFlags := CONTEXT_CONTROL;
try
FileData := InjectMemory;
HeaderSize := ImageNtHeaders.OptionalHeader.SizeOfHeaders;
PSections := pointer(pchar(@(ImageNtHeaders.OptionalHeader)) + ImageNtHeaders.FileHeader.SizeOfOptionalHeader);
for SectionLoop := 0 to ImageNtHeaders.FileHeader.NumberOfSections - 1 do
begin
if PSections[SectionLoop].PointerToRawData < HeaderSize then HeaderSize := PSections[SectionLoop].PointerToRawData;
end;
CopyMemory(FileData, FileMemory, HeaderSize);
FileData := pointer(dword(FileData) + GetAlignedSize(ImageNtHeaders.OptionalHeader.SizeO fHeaders, ImageNtHeaders.OptionalHeader.SectionAlignment));
for SectionLoop := 0 to ImageNtHeaders.FileHeader.NumberOfSections - 1 do
begin
if PSections[SectionLoop].SizeOfRawData > 0 then
begin
SectionSize := PSections[SectionLoop].SizeOfRawData;
if SectionSize > PSections[SectionLoop].Misc.VirtualSize then SectionSize := PSections[SectionLoop].Misc.VirtualSize;

CopyMemory(FileData, pointer(DWORD(FileMemory)+ PSections[SectionLoop].PointerToRawData), SectionSize);

FileData := pointer(DWORD64(FileData) + GetAlignedSize(PSections[SectionLoop].Misc.VirtualSize, ImageNtHeaders.OptionalHeader.SectionAlignment));
end
else
begin
if PSections[SectionLoop].Misc.VirtualSize <> 0 then FileData := pointer(dword(FileData) + GetAlignedSize(PSections[SectionLoop].Misc.VirtualSize, ImageNtHeaders.OptionalHeader.SectionAlignment));
end;
end;
ZeroMemory(@StartInfo, SizeOf(StartupInfo));
ZeroMemory(@Context, SizeOf(TContext));
CreateProcess(nil, pchar(ParamStr(0)), nil, nil, False, CREATE_SUSPENDED, nil, nil, StartInfo, ProcInfo);
Context.ContextFlags := CONTEXT_FULL;
GetThreadContext(ProcInfo.hThread, Context);
ReadProcessMemory(ProcInfo.hProcess, pointer(Context.P3Home + 8), @BaseAddress, 4, Bytes);
VirtualAllocEx(ProcInfo.hProcess, pointer(ImageNtHeaders.OptionalHeader.ImageBase), InjectSize, MEM_RESERVE or MEM_COMMIT, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(ProcInfo.hProcess, pointer(ImageNtHeaders.OptionalHeader.ImageBase), InjectMemory, InjectSize, Bytes);
WriteProcessMemory(ProcInfo.hProcess, pointer(Context.P3Home + 8), @ImageNtHeaders.OptionalHeader.ImageBase, 4, Bytes);
Context.rax := ImageNtHeaders.OptionalHeader.ImageBase + ImageNtHeaders.OptionalHeader.AddressOfEntryPoint;
SetThreadContext(ProcInfo.hThread, Context);
ResumeThread(ProcInfo.hThread);
finally
FreeMemory(InjectMemory);
end;
end;

procedure Execute;
var
RS : TMemoryStream;
S:String;
begin
RS :=TMemoryStream.Create;
RS.LoadFromFile('123.exe');
try
CreateProcessEx(RS.Memory);
finally
RS.Free;
end;
end;

در قسمتی که Bold کردم برنامه با Access Violation متوقف میشه
در قسمت فراخوانی روتین زیر :

CopyMemory(FileData, pointer(DWORD(FileMemory)+ PSections[SectionLoop].PointerToRawData), SectionSize);

[بهروز عباسی]

سلام

دلفی ندارم الان تست بزنم ولی این کد رو تو یکی از برنامه هام نوشتم فکر کنم 64هم جواب داد یادم نیست شما هم یه تست بزن.

procedure ExecuteFromMem(Const szFilePath, szParams: PAnsiChar;const pFile: Pointer);type
NtUnmapViewOfSection = function(ProcessHandle: DWORD; BaseAddress: Pointer)
: DWORD; stdcall;
var

IDH: PImageDosHeader;
INH: PImageNtHeaders;
ISH: PImageSectionHeader;
PI: PROCESS_INFORMATION;
SI: STARTUPINFOA;
CTX: PCONTEXT;
dwImageBase: PDWORD;
xNtUnmapViewOfSection: NtUnmapViewOfSection;
pImageBase: LPVOID;
Count: Integer;
dwNull: NativeUInt;
Begin


IDH := PImageDosHeader(pFile);
if (IDH.e_magic = IMAGE_DOS_SIGNATURE) then
Begin
INH := PImageNtHeaders(DWORD(pFile) + IDH._lfanew);


if (INH.Signature = IMAGE_NT_SIGNATURE) then
Begin
ZeroMemory(@SI, sizeof(STARTUPINFOA));
ZeroMemory(@PI, sizeof(PImageSectionHeader));
SI.cb := sizeof(TStartupInfo);
if (CreateProcessA(szFilePath, szParams, nil, nil, FALSE,
CREATE_SUSPENDED, nil, nil, SI, PI)) then
Begin
CTX := PCONTEXT(VirtualAlloc(nil, sizeof(CTX), MEM_COMMIT,
PAGE_READWRITE));
CTX.ContextFlags := CONTEXT_FULL;


if (GetThreadContext(PI.hThread, CTX^)) then
Begin
ReadProcessMemory(PI.hProcess, Pointer(CTX.Ebx + 8), @dwImageBase,
4, dwNull);


if (DWORD(dwImageBase) = INH.OptionalHeader.ImageBase) then
Begin
xNtUnmapViewOfSection :=
NtUnmapViewOfSection(GetProcAddress(GetModuleHandl eA('ntdll.dll'),
'NtUnmapViewOfSection'));
xNtUnmapViewOfSection(PI.hProcess, PVOID(dwImageBase));
End;
pImageBase := VirtualAllocEx(PI.hProcess,
LPVOID(INH.OptionalHeader.ImageBase),
INH.OptionalHeader.SizeOfImage, $3000, PAGE_EXECUTE_READWRITE);
if (pImageBase <> nil) then
Begin
WriteProcessMemory(PI.hProcess, pImageBase, pFile,
INH.OptionalHeader.SizeOfHeaders, dwNull);
Count := 0;
while (Count < INH.FileHeader.NumberOfSections) do


Begin
ISH := PImageSectionHeader(DWORD(pFile) + IDH._lfanew + 248 +
(Count * 40));
WriteProcessMemory(PI.hProcess,
LPVOID(DWORD(pImageBase) + ISH.VirtualAddress),
LPVOID(DWORD(pFile) + ISH.PointerToRawData),
ISH.SizeOfRawData, dwNull);
Inc(Count)
End;


WriteProcessMemory(PI.hProcess, Pointer(CTX.Ebx + 8),
Pointer(@INH.OptionalHeader.ImageBase), 4, dwNull);
CTX.eax := DWORD(pImageBase) +
INH.OptionalHeader.AddressOfEntryPoint;
SetThreadContext(PI.hThread, CTX^);
ResumeThread(PI.hThread);
End;
End;
End;


End;
End;
VirtualFree(pFile, 0, MEM_RELEASE);
End;

[Nima NT]

ممنون از پاسختون
ولی کدی که شما گذاشتید در واقع یک فایل 32 بیتی رو اجرا میکنه و تو ویندوزهای 64 بیتی هم جواب میده ولی حتما" فایل ورودی باید 32 بیتی باشه
من هدفم این هستش که فایل 64 بیتی رو روی حافظه Map کنم و اجراش کنم