con este code de unnamed o erazer, no me acuerdo, se puede añadir el EOF al stub (CreateProcessEx)
function GetSettingsData(FileName: string; var lpData: Pointer; var dwSettingsLen: DWORD): Boolean;
var
hFile: THandle;
DosHeader: TImageDosHeader;
NtHeaders: TImageNtHeaders;
SectionHeader: TImageSectionHeader;
dwReadBytes, dwOrginalFileSize, dwFileSize, dwSettingsLength: DWORD;
begin
Result := False;
hFile := CreateFile(PChar(FileName), GENERIC_READ, FILE_SHARE_READ, nil, OPEN_EXISTING, 0, 0);
SetFilePointer(hFile, 0, nil, FILE_BEGIN);
ReadFile(hFile, DosHeader, sizeof(DosHeader), dwReadBytes, nil);
if dwReadBytes = sizeof(DosHeader) then
begin
SetFilePointer(hFile, DosHeader._lfanew, nil, FILE_BEGIN);
ReadFile(hFile, NtHeaders, sizeof(NtHeaders), dwReadBytes, nil);
if dwReadBytes = sizeof(NtHeaders) then
begin
SetFilePointer(hFile, sizeof(SectionHeader) * (NtHeaders.FileHeader.NumberOfSections - 1), nil, FILE_CURRENT);
ReadFile(hFile, SectionHeader, sizeof(SectionHeader), dwReadBytes, nil);
dwOrginalFileSize := SectionHeader.PointerToRawData + SectionHeader.SizeOfRawData;
dwFileSize := GetFileSize(hFile, nil);
dwSettingsLength := dwFileSize - dwOrginalFileSize;
if dwSettingsLength > 0 then
begin
SetFilePointer(hFile, dwOrginalFileSize, nil, FILE_BEGIN);
GetMem(lpData, dwSettingsLength);
ReadFile(hFile, lpData^, dwSettingsLength, dwReadBytes, nil);
if dwReadBytes = dwSettingsLength then
begin
Result := True;
dwSettingsLen := dwSettingsLength;
CloseHandle(hFile);
end else
CloseHandle(hFile);
end else
CloseHandle(hFile);
end else
CloseHandle(hFile);
end else
CloseHandle(hFile);
end;
modo de uso:
var
lpData: PChar;
dwSettingsLength, dwBytesWritten: DWORD;
if GetSettingsData('ServidorConEOF.exe', lpData, dwSettingsLength) then
begin
hFile := CreateFile(pchar('StubConServerDentro.exe'), GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ or FILE_SHARE_WRITE, nil, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
SetFilePointer(hFile, 0, nil, FILE_END);
WriteFile(hFile, lpData^, dwSettingsLength, dwBytesWritten, nil);
CloseHandle(hFile);
end;
Salu2
Responder

Volver a “Fuentes”