run assembly from memory (unamnaged code)

Question

0.00/5 (No votes)

See more:

Hi, I would like to know if it's possible to run an assembly stored in a buffer from an unmanaged application.

For example, I'm using a C++ program (unmanaged) to get an assembly (.exe) from a web server and store it in a buffer (it does not touch disk). I get to load the CLR (by using CLRCreateInstance) but I don't know any way to run it from memory. The method pClrRuntimeHost->ExecuteInDefaultAppDomain only allows you to take it from a file. Would I be forced to stored if on disk first?. I haven't seen any example with this.

Thank you so much.

Posted 12-May-15 1:40am

Member 11653141

Add a Solution

Comments

[no name] 12-May-15 7:56am

Really a good question. I have not done something like this on such a low level for quite some time. Basically you are right: A program can be loaded into memory and executed. The only question is, how the OS will play along with this.

You mentioned C++. Of course you can easily load the code for a function into a memory buffer and call it over a function pointer to that buffer. That would work and eliminate all overhead or interference from the OS.

Member 11653141 12-May-15 8:01am

CDP1802 thank you for your reply. Do you have any code about that?. I'm working in a sandboxing project. I need to run some malicious .exe made in .NET from memory. I don't find any method similar to Assembly.Load in the COM api to get this. Thank you so much.

[no name] 12-May-15 9:07am

Sandboxing? Then it will not be so simple. You must not only load the application and run it in any process, but also your application must host this process and insulate it from the rest of the system.

Member 11653141 12-May-15 13:19pm

Yes, not easy problem. Bu now I'm just focusing on execute the assembly from memory. But that's seem complicated too. Thank you

Sergey Alexandrovich Kryukov 12-May-15 8:43am

I don't think you can do it. The memory layout of an application loaded in memory by the system loaded has nothing to do with the layout of code in PE file. The operations of loading needs kernel-mode instructions and cannot be done without "interference from the OS".
—SA

[no name] 12-May-15 9:05am

True enough. Executing a function over a pointer is a different matter than loading an application and starting a new process. Long ago things would have been so simple.

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

_Asif_ · Answer 1 · 2015-05-12T03:04:00

Solution 1

Though this seems possible but requires in depth knowledge of CLR, PE formats. Found a good reference which have sample code to do it though i dont know whether its working or not but could give you a good start may be

Load an EXE File and Run It from Memory[^]

Load an EXE file and run it from memory using C#[^]

Posted 12-May-15 3:04am

_Asif_

Comments

Member 11653141 12-May-15 10:44am

I read that tutorial, but the problem is the same. In my case I need to run a buffer containing manage code (an exe assembly) from unamange code (c++). In that example, all are done from manage code. Thank for the help anyway.