从内存中加载并启动一个exe.docxVIP

从内存中加载并启动一个exe(C++版)原理:1. 把你的程序读要内存2. 以 CREATE_SUSPENDED模式CreateProcess打开svchost.exe3. 修改svchost.exe页面的属性，然后把要运行的那个程序的内容拷贝到svchost.exe页面4. 然后再运行实质想当于是披着/svchost.exe进程的相关信息/这张皮，而皮里面的肉都被改了原文来自哪里忘记了，。呵呵//#include stdio.h#include windows.h#include tlhelp32.h//#include ntpsapi.hstruct PEHeader{?? unsigned long signature;?? unsigned short machine;?? unsigned short numSections;?? unsigned long timeDateStamp;?? unsigned long pointerToSymbolTable;?? unsigned long numOfSymbols;?? unsigned short sizeOfOptionHeader;?? unsigned short characteristics;};typedef struct PEHeader PE_Header;struct PEExtHeader{?? unsigned short magic;?? unsigned char majorLinkerVersion;?? unsigned char minorLinkerVersion;?? unsigned long sizeOfCode;?? unsigned long sizeOfInitializedData;?? unsigned long sizeOfUninitializedData;?? unsigned long addressOfEntryPoint;?? unsigned long baseOfCode;?? unsigned long baseOfData;?? unsigned long imageBase;?? unsigned long sectionAlignment;?? unsigned long fileAlignment;?? unsigned short majorOSVersion;?? unsigned short minorOSVersion;?? unsigned short majorImageVersion;?? unsigned short minorImageVersion;?? unsigned short majorSubsystemVersion;?? unsigned short minorSubsystemVersion;?? unsigned long reserved1;?? unsigned long sizeOfImage;?? unsigned long sizeOfHeaders;?? unsigned long checksum;?? unsigned short subsystem;?? unsigned short DLLCharacteristics;?? unsigned long sizeOfStackReserve;?? unsigned long sizeOfStackCommit;?? unsigned long sizeOfHeapReserve;?? unsigned long sizeOfHeapCommit;?? unsigned long loaderFlags;?? unsigned long numberOfRVAAndSizes;?? unsigned long exportTableAddress;?? unsigned long exportTableSize;?? unsigned long importTableAddress;?? unsigned long importTableSize;?? unsigned long resourceTableAddress;?? unsigned long resourceTableSize;?? unsigned long exceptionTableAddress;?? unsigned long exceptionTableSize;?? unsigned long certFilePointer;?? unsigned long certTableSize;?? unsigned long relocationTableAddress;?? unsigned long relo