How can I run an executable from RAM using C++?

Question

How can I run an executable from RAM using C++?

The executable is in RAM, and I know the address, how do I call into the program from mine?

Answer 1

This sort of things comes normally out of the dark corners of the world. ;-)

In combination with tools like metasploit it would be great to create process just out of ram and so a couple of guys tried to reimplement all the stuff that happens down in CreateProcess(). After a while they just found out that it is much too complex (see this PDF site 12f) to get this to work and they tried to find another solution and here it is: They call a normal CreateProcess() with a common program (e.g. notepad.exe), but they start it with ThreadSuspended. Then they injected a new thread into this process, which will be filled up from memory. Afterwards they told this thread to run and so they got a new process filled from memory.

So this is just the big picture and it is a whole mess (and normally not the right way) to do this stuff. If you really interested in this part, then you have an idea to search for.

And by the way, don't think you can do this in C#. This is normally done in C/C++ or even Assembler...