title: Execute PE from memory
body: <p>I tried to write LoadLibrary function in C.
  The function gets a path to a DLL file which, normally, pops up message box when it loads (I tried to run that DLL file using the original LoadLibrary function and it works).</p>
  
  <p>Basically, the DLL content is loaded into a buffer, parsed and runs from entry point.</p>
  
  <p>In <code>VirtualAllocEx</code> function, I use <code>PAGE_READWRITE</code> protection mode. Then, when running the line <code>f(nth-&gt;OptionalHeader.ImageBase, DLL_PROCESS_ATTACH, NULL)</code>, I get the following error message: <code>Exception thrown at 0x10011032 in PE.exe: 0xC0000005: Access violation executing location 0x10011032.</code> (0x10011032 is entry point address).</p>
  
  <p>If I change the mode to <code>PAGE_EXECUTE_READWRITE</code>, the error message is: <code>Exception thrown at 0x00019644 in PE.exe: 0xC0000005: Access violation executing location 0x00019644.</code> (No idea what is that address).</p>
  
  <p>I think that it's clear why it's not smart to allow execution in all sectors of the PE, but I did it for testing purposes only. In the final code, I'll need to write it properly.</p>
  
  <p>My code is attached.
  (BTW, if you have other suggestions that are not related to my question - I'll glad to know).</p>
  
  <pre><code>#include &lt;Windows.h&gt;
  
  typedef HMODULE func(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved);
  
  HMODULE LoadLibraryFromMem(char* dllPath)
  
  {
      DWORD read;
      HANDLE handle;
      handle = CreateFileA(dllPath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
      DWORD size = GetFileSize(handle, NULL);
      PVOID vDll = VirtualAlloc(NULL, size, MEM_COMMIT, PAGE_READWRITE);
      BOOL r = ReadFile(handle, vDll, size, &amp;read, NULL);
      CloseHandle(handle);
      PIMAGE_DOS_HEADER dosh = (PIMAGE_DOS_HEADER)vDll;
      PIMAGE_NT_HEADERS nth = (PIMAGE_NT_HEADERS)((PBYTE)vDll + dosh-&gt;e_lfanew);
      handle = GetCurrentProcess();
      PVOID vImg = VirtualAllocEx(
          handle,
          nth-&gt;OptionalHeader.ImageBase,
          nth-&gt;OptionalHeader.SizeOfImage,
          MEM_RESERVE | MEM_COMMIT,
          PAGE_READWRITE
      ); // HERE --&gt; PAGE_EXECUTE_READWRITE
      WriteProcessMemory(
          handle,
          vImg,
          vDll,
          nth-&gt;OptionalHeader.SizeOfHeaders,
          0
      );
      PIMAGE_SECTION_HEADER sech = IMAGE_FIRST_SECTION(nth);
      for (size_t i = 0; i &lt; nth-&gt;FileHeader.NumberOfSections; i++)
          WriteProcessMemory(
              handle,
              (PBYTE)vImg + sech[i].VirtualAddress,
              (PBYTE)vDll + sech[i].PointerToRawData,
              sech[i].SizeOfRawData,
              0
          );
      PIMAGE_IMPORT_DESCRIPTOR impd = nth-&gt;OptionalHeader.ImageBase + nth-&gt;OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
  
      HANDLE proc;
      while (((PIMAGE_IMPORT_DESCRIPTOR)impd)-&gt;Name)
      {
          LPSTR dllName = (nth-&gt;OptionalHeader.ImageBase + ((PIMAGE_IMPORT_DESCRIPTOR)impd)-&gt;Name);
          HMODULE dllAdr = LoadLibraryA(dllName);
          PDWORD iat = nth-&gt;OptionalHeader.ImageBase + ((PIMAGE_IMPORT_DESCRIPTOR)impd)-&gt;FirstThunk;
  
          while (*iat)
          {
              LPSTR funcName = ((PIMAGE_IMPORT_BY_NAME)(nth-&gt;OptionalHeader.ImageBase + *iat))-&gt;Name;
              proc = GetProcAddress(dllAdr, funcName);
              if (!proc)
                  return NULL;
              impd-&gt;FirstThunk = proc;
              iat++;
          }
          impd++;
      }
      func* f = (func*)(nth-&gt;OptionalHeader.ImageBase + nth-&gt;OptionalHeader.AddressOfEntryPoint);
      f(nth-&gt;OptionalHeader.ImageBase, DLL_PROCESS_ATTACH, NULL);
  }
  
  int main()
  {
      LoadLibraryFromMem("mydll.dll");
      return 0;
  }
  </code></pre>
  
  <p>Thanks in advance!</p>