Executing EXE file with arguments about memorymodule HOT 12 OPEN

Well how does your executable get its arguments?

Is it via GetCommandLineA()/GetCommandLineW()? You can either hook that or replace the saved pointer.
MOV EAX, DS:[some address]
RETN
Starting with Win 7 (IIRC) it's in another DLL so you have to search in kernelbase.dll

Is it via int main(int argc, char** argv)? That is set by your CRT, the one provided by Visual Studio uses msvcrt.dll's __getmainargswhich uses_acmdln` (Both symbols are exported). You can either hook that or replace the saved pointer.

from memorymodule.

I don't want the solution to be limited to only one executable, I would like it to be working as if I did :
executables.exe -arg1 -arg2

is there a way to do that with MemoryModule ?

I don't know yet which executable I will be using and how it work internally

from memorymodule.

i have added support for arguments in a pull request (that has since been accepted) to a fork by another person -> https://github.com/kost/MemoryModule once his changes are included, arguments will work

from memorymodule.

I've partially implemented it in my fork.
https://github.com/FusixGit/MemoryModule
Interception takes place at the stage of import.

from memorymodule.

This can be done with MemoryLoadLibraryEx() by setting the *userdata to *argv[]. Both of our patches are not needed. (I recommend this issue be closed)

from memorymodule.

@vyrus001 Not quite. The exe will still call GetCommandLine which returns whatever args were passed to the program using MemoryModule. In order to pass args to a memory loaded exe you will have to find and replace the GetCommandLine function with a pointer to a string in memory that contains the arguments.

from memorymodule.

@kernel-sanders any illustration for that ?

from memorymodule.

It has been done in other projects, see: Invoke-ReflectivePEInjection.ps1#L2058

However, it is likely easier to just use donut.

from memorymodule.

how to pass arguments to a dll ? @kernel-sanders

from memorymodule.

It looks like you are attempting to write cryptomining malware. I suggest spending your talents elsewhere.

from memorymodule.

not really. I am making experiments. @kernel-sanders i work with security

from memorymodule.

from memorymodule.