execute exe in memory

4
votes

I was trying out this code.

execute EXE from memory

I am hitting on error "Types of actual and formal var parameters must be identical" . Any help in this regard is highly appreciated.

......
   ReadProcessMemory(ProcInfo.hProcess, pointer(Context.Ebx + 8), @BaseAddress, 4, Bytes);    <-- error is here
.......

and

.....
   WriteProcessMemory(ProcInfo.hProcess, pointer(ImageNtHeaders.OptionalHeader.ImageBase), InjectMemory, InjectSize, Bytes);   <---- error here
......

I am using Delphi XE2 and windows 7 64 bit. Some of my friends are able to compile it under D7 environment. Any help is appreciated.

1
delphidelphi-xe2
Can't you just find out yourself? Look up online what kind of params ReadProcessMemory needs (or use Ctrl-Shift-Space to get the parameter list in Delphi) and check with your parameter types. – Jan Doggen
@WarrenP, I would use this e.g. for installer; you may extract the executable files from setup file's resources and run them without writing to disk. It will be much faster ;) – TLama
@WarrenP I am trying to create a wrapper module to protect my exe. Once it is wrapped up, i can apply some kind of packing techniques. Fro e.g. ASPack – jimsweb
@TLama, an installer doesn't have to do things like this to be faster. It's an installer - it runs once typically, and saving a few seconds doesn't make a difference. Having your installer flagged as being malware or a virus does, however - "tricks" like this shouldn't be used for a routine purpose. I disagree with the asker wanting to do this on their own, too; there are reasons commercial software charges for accomplishing this, and since they've done all the work you should use them. If your app is important enough to need protection like this, it's important enough to be worth the money. – Ken White
@Ken, I'm quite extremist in a performance point of view, but you're absolutely right; antiviral software didn't cross my mind. Fortunately I'm a satisfied InnoSetup user ;) – TLama

1 Answers

5
votes

The error tells you that one of the variables you are passing as parameter does not have the required type. The error is in a var parameter. The final parameter for both these functions is the only var parameter so clearly Bytes is not the required type.

The solution is to make Bytes match the type specified in the declaration of ReadProcessMemory and WriteProcessMemory. In XE2 that type is SIZE_T. So you just need to change your definition of Bytes to be of type SIZE_T.

Here are the XE2 declarations:

function ReadProcessMemory(hProcess: THandle; const lpBaseAddress: Pointer;
  lpBuffer: Pointer; nSize: SIZE_T; var lpNumberOfBytesRead: SIZE_T): BOOL; stdcall;
function WriteProcessMemory(hProcess: THandle; const lpBaseAddress: Pointer;
  lpBuffer: Pointer; nSize: SIZE_T; var lpNumberOfBytesWritten: SIZE_T): BOOL; stdcall;