change entry point address
-
PIMAGE_DOS_HEADER pDosHeader; PIMAGE_NT_HEADERS pNtHeader; DWORD NewEntryPoint = (DWORD)0x40123456; HANDLE hFile; //Handle for our main file. HANDLE hFileMapping; //Handle to the file in memory. hFile = CreateFile("Example.exe",FILE_ALL_ACCESS,FILE_SHARE_READ,0,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0); hFileMapping = CreateFileMapping(hFile,0,PAGE_READWRITE,0,0,0); pDosHeader = (PIMAGE_DOS_HEADER)MapViewOfFile(hFileMapping,FILE_MAP_READ | FILE_MAP_WRITE,0,0,0); pNtHeader = (PIMAGE_NT_HEADERS)((DWORD)pDosHeader + (DWORD)pDosHeader->e_lfanew); char apa[1024]; itoa((DWORD)pNtHeader->OptionalHeader.AddressOfEntryPoint,apa,1024); MessageBox(0,apa,"a",MB_OK); (DWORD)pNtHeader->OptionalHeader.AddressOfEntryPoint = (DWORD) NewEntryPoint;this:pNtHeader = (PIMAGE_NT_HEADERS)((DWORD)pDosHeader + (DWORD)pDosHeader->e_lfanew);makes an error like this: Unhandled exception at 0x00411b52 in pan.exe: 0xC0000005: Access violation reading location 0x0000003c. how can I make this work right? -
PIMAGE_DOS_HEADER pDosHeader; PIMAGE_NT_HEADERS pNtHeader; DWORD NewEntryPoint = (DWORD)0x40123456; HANDLE hFile; //Handle for our main file. HANDLE hFileMapping; //Handle to the file in memory. hFile = CreateFile("Example.exe",FILE_ALL_ACCESS,FILE_SHARE_READ,0,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0); hFileMapping = CreateFileMapping(hFile,0,PAGE_READWRITE,0,0,0); pDosHeader = (PIMAGE_DOS_HEADER)MapViewOfFile(hFileMapping,FILE_MAP_READ | FILE_MAP_WRITE,0,0,0); pNtHeader = (PIMAGE_NT_HEADERS)((DWORD)pDosHeader + (DWORD)pDosHeader->e_lfanew); char apa[1024]; itoa((DWORD)pNtHeader->OptionalHeader.AddressOfEntryPoint,apa,1024); MessageBox(0,apa,"a",MB_OK); (DWORD)pNtHeader->OptionalHeader.AddressOfEntryPoint = (DWORD) NewEntryPoint;this:pNtHeader = (PIMAGE_NT_HEADERS)((DWORD)pDosHeader + (DWORD)pDosHeader->e_lfanew);makes an error like this: Unhandled exception at 0x00411b52 in pan.exe: 0xC0000005: Access violation reading location 0x0000003c. how can I make this work right?Hi Spirit, First id like to declare that Ive never used the functions that you're using in this code snippet but here's my two bobs worth. 1) It looks like MapViewOfFile is returning NULL (which it does in case of error). (so pDosHeader->e_lfanew evaluates to 0x3c... sounds feasible?) 2) Reading to doco it looks like the "dwDesiredAccess" flag isnt "addable" (Ths do saye "This parameter can be one of the following values"). It also says that FILE_MAP_WRITE by iself gives RW access. Try playing with the MapViewOfFile args and check the returned value for NULL maybe Cheers
-
PIMAGE_DOS_HEADER pDosHeader; PIMAGE_NT_HEADERS pNtHeader; DWORD NewEntryPoint = (DWORD)0x40123456; HANDLE hFile; //Handle for our main file. HANDLE hFileMapping; //Handle to the file in memory. hFile = CreateFile("Example.exe",FILE_ALL_ACCESS,FILE_SHARE_READ,0,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0); hFileMapping = CreateFileMapping(hFile,0,PAGE_READWRITE,0,0,0); pDosHeader = (PIMAGE_DOS_HEADER)MapViewOfFile(hFileMapping,FILE_MAP_READ | FILE_MAP_WRITE,0,0,0); pNtHeader = (PIMAGE_NT_HEADERS)((DWORD)pDosHeader + (DWORD)pDosHeader->e_lfanew); char apa[1024]; itoa((DWORD)pNtHeader->OptionalHeader.AddressOfEntryPoint,apa,1024); MessageBox(0,apa,"a",MB_OK); (DWORD)pNtHeader->OptionalHeader.AddressOfEntryPoint = (DWORD) NewEntryPoint;this:pNtHeader = (PIMAGE_NT_HEADERS)((DWORD)pDosHeader + (DWORD)pDosHeader->e_lfanew);makes an error like this: Unhandled exception at 0x00411b52 in pan.exe: 0xC0000005: Access violation reading location 0x0000003c. how can I make this work right?Maybe because in MapViewOfFile you left the last parameter at 0 (dwNumberOfBytesToMap) instead of setting it to size of file?