Download exe from exe

I export the function [using _declspec (dllexport)] from C ++ exe. The function works great when calling exe itself. I load this exe (allows calling this exe1) from another exe [test project exe - I will call this exe2] using static linking, that is, I use the exe1.lib file when compiling exe2 and exe2 loads it into memory when I run it like this same as any dll. This causes the function to fail during execution.

The exact problem is discovered during parsing for the case switch statement in a function.

Build code when exe1 calls a function

   switch (dwType)
0040FF84  mov         eax,dword ptr [dwType] 
0040FF87  mov         dword ptr [ebp-4],eax 
0040FF8A  cmp         dword ptr [ebp-4],0Bh 
0040FF8E  ja          $LN2+7 (40FFD2h) 
0040FF90  mov         ecx,dword ptr [ebp-4] 
0040FF93  jmp         dword ptr  (40FFE0h)[ecx*4] 

Consider the last two instructions. Mov moves the passed argument to ecx. At 40EFF0h we have addresses for various instructions for the respective case descriptions. So jmp will lead us to the corresponding case instructions

, exe2

   switch (dwType)
0037FF84  mov         eax,dword ptr [dwType] 
0037FF87  mov         dword ptr [ebp-4],eax 
0037FF8A  cmp         dword ptr [ebp-4],0Bh 
0037FF8E  ja          $LN2+7 (37FFD2h) 
0037FF90  mov         ecx,dword ptr [ebp-4] 
0037FF93  jmp         dword ptr [ecx*4+40FFE0h]

, ? . . exe1 , , , , , 0x0040000 [ exes exks]. , , 40FFE0h, . 40FFE0 , , , .

exe1 dll?

+3
2

. , .

, . exe, "Linker- > Advenced- > Fixed base address", .
, , , , , , EXE DllMain(). , CRT , .

,

+1

? , .exe .dll rundll32, ?

: . , Win32 (0x0040000 ) , , , .

, : - IMAGE_BASE_RELOCATION, .exe. - , .exe - (, )

.exe , . , , (VirtualAlloc ..), .

.exe , , , , , .

: Shoosh, .

+1

Source: https://habr.com/ru/post/1728163/


All Articles