fancycode
Executing EXE file with arguments
Hi, first of all great job, this module works really well with all the DLL executables I created.
However I now want to execute EXE executables from memory with arguments. I saw your code is also able to execute EXE files, but I don't know were I should provide the arguments.
Could you tell me the right way to do this ?
Well how does your executable get its arguments?
Is it via GetCommandLineA()/GetCommandLineW()? You can either hook that or replace the saved pointer.
MOV EAX, DS:[some address]
RETN
Starting with Win 7 (IIRC) it's in another DLL so you have to search in kernelbase.dll
Is it via int main(int argc, char** argv)? That is set by your CRT, the one provided by Visual Studio uses msvcrt.dll's __getmainargswhich uses_acmdln` (Both symbols are exported). You can either hook that or replace the saved pointer.
I don't want the solution to be limited to only one executable, I would like it to be working as if I did : executables.exe -arg1 -arg2
is there a way to do that with MemoryModule ?
I don't know yet which executable I will be using and how it work internally
i have added support for arguments in a pull request (that has since been accepted) to a fork by another person -> https://github.com/kost/MemoryModule once his changes are included, arguments will work
I've partially implemented it in my fork. https://github.com/FusixGit/MemoryModule Interception takes place at the stage of import.
This can be done with MemoryLoadLibraryEx() by setting the *userdata to *argv[]. Both of our patches are not needed. (I recommend this issue be closed)
@vyrus001 Not quite. The exe will still call GetCommandLine which returns whatever args were passed to the program using MemoryModule. In order to pass args to a memory loaded exe you will have to find and replace the GetCommandLine function with a pointer to a string in memory that contains the arguments.
It has been done in other projects, see: Invoke-ReflectivePEInjection.ps1#L2058
However, it is likely easier to just use donut.
It looks like you are attempting to write cryptomining malware. I suggest spending your talents elsewhere.
