64bit Anw. soll 32bit Anw. ausm Speicher starten

[TheGame1492]

Hoi,

ich versuche grad mittels einer 64bit Anwendung eine 32bit Anwendung aus dem Speicher zu starten, dies klappt aber irgendwie nicht so recht.

(Eine 64bit Anwendung zu starten dagegen schon).

Ich benutze dazu folgenden Code:

Code:

.
.
.
var
  mem: TMemoryStream;
  NtHeaders: PImageNtHeaders;
  ProcessInfo: TProcessInformation;
  Success: Boolean;
  Context: TContext;
  BaseAddress: Pointer;
  BytesWritten: NativeUInt;
  Sections: PImageSectionHeaders;
  i: ULONG;
  OldProtect: ULONG;
  StartupInfo: TStartupInfo;
  BytesRead: nativeuint;//SIZE_T;
  parameter: string;
  filename: string;
.
.
.

    filename := ExtractFilePath(paramStr(0))+'HelloWorldInFile64.exe';
    if not FileExists( filename ) then
      exit;

    mem := TMemoryStream.Create;
    mem.LoadFromFile( filename );

    FillChar(ProcessInfo, SizeOf(TProcessInformation), 0);
    FillChar(StartupInfo, SizeOf(TStartupInfo),        0);

    StartupInfo.wShowWindow := SW_HIDE;
    startupinfo.cb := sizeof(STARTUPINFO);
    StartupInfo.dwFlags := STARTF_USESHOWWINDOW;
    parameter := ParamStr(0);

    if CreateProcess(nil, pchar(parameter), nil, nil, False, CREATE_SUSPENDED,
      nil, nil, StartupInfo, ProcessInfo) then
    begin

      Success := False;
      try
        Context.ContextFlags := CONTEXT_INTEGER;
        if GetThreadContext(ProcessInfo.hThread, Context) then
        begin
          if ReadProcessMemory( ProcessInfo.hProcess, Pointer(Context.Rdx + 16 ), @BaseAddress, SizeOf(BaseAddress), BytesRead ) then
          begin
            if zwUnmapViewOfSection(ProcessInfo.hProcess, BaseAddress) >= 0 then
            begin
   
              NtHeaders := PImageNtHeaders( Cardinal(mem.Memory) + Cardinal(PImageDosHeader(mem.Memory)._lfanew));

              BaseAddress := VirtualAllocEx( ProcessInfo.hProcess,
                                                   Pointer(NtHeaders.OptionalHeader.ImageBase),
                                                   NtHeaders.OptionalHeader.SizeOfImage,
                                                   MEM_RESERVE or MEM_COMMIT, PAGE_READWRITE);  //hier muss der fehler liegen?!?!??

              if Assigned(BaseAddress) then
              if WriteProcessMemory( ProcessInfo.hProcess, BaseAddress, mem.Memory, NtHeaders.OptionalHeader.SizeOfHeaders, BytesWritten) then
              begin
                Sections := PImageSectionHeaders(ImageFirstSection(NtHeaders));
                for i := 0 to NtHeaders.FileHeader.NumberOfSections - 1 do
                  if WriteProcessMemory( ProcessInfo.hProcess, Pointer(Cardinal(BaseAddress) + Sections[i].VirtualAddress), Pointer(Cardinal(mem.Memory) + Sections[i].PointerToRawData), Sections[i].SizeOfRawData, BytesWritten) then
                    VirtualProtectEx( ProcessInfo.hProcess, Pointer(Cardinal(BaseAddress) + Sections[i].VirtualAddress), Sections[i].Misc.VirtualSize, Protect(Sections[i].Characteristics), OldProtect);

                if WriteProcessMemory( ProcessInfo.hProcess, Pointer(Context.Rdx + 16 ), @BaseAddress, SizeOf(BaseAddress), BytesWritten) then
                begin
                  Context.Rcx := ULONG(BaseAddress) + NtHeaders.OptionalHeader.AddressOfEntryPoint;
                  Success := SetThreadContext(ProcessInfo.hThread, Context);
                end;
              end;
            end;
          end;
        end;
      finally

        if not Success then
        begin
          TerminateProcess(ProcessInfo.hProcess, 0);
        end
        else
        begin
          ResumeThread(ProcessInfo.hThread);

          while WaitForSingleObject(ProcessInfo.hProcess, 0) = WAIT_TIMEOUT do
          begin
            ProcessMessage;
            Sleep(50);
          end;
          WaitForSingleObject(ProcessInfo.hProcess, INFINITE);

        end;

      end;

    CloseHandle(ProcessInfo.hProcess);
    CloseHandle(ProcessInfo.hThread);

    mem.Free;
  end;

Meine Frage, kann das überhaupt funzen???

Beim VirtualAllocEx scheint der Fehler zu liegen!?