Question

We may all have used (sooner or later) Parameters to define how our Application should start or to add more infos to it. Either you can use lpParameters/lpCommandLine in ShellExecute(ex)/CreateProcess or even use it in a direct call in the cmd like this MyApplication.exe -parameter1 -parameter2 -n.

Sometimes there are conflicts with applications that use the same parameter names for different purposes or nowadays you can even see which parameters have been used for an Application. I was wondering if it is possible to use a different method on how to add more infos to my application BEFORE it actually starts (like parameters). I don't know much about the PE System (yet), but I was wondering if it was possible to use the CreateProcess API and start the Application suspended - write/change/modify (with WriteProcessMemory) an offset of a constant (or var) that I have declared in my sourcecode (or something like that...) and finally resume it.

I'm sure it is possible but It comes with some questions like:

  1. How/Where can I get the offset of a constant from a PE file?
  2. What happens if the file is packed/crypted?
  3. Many more

So the final question would be - What would be an alternative for parameters? (maybe based on my idea?!)

Was it helpful?

Solution

There are other ways to pass data to a new process when it starts running without resorting to hacking its memory beforehand.

How do I pass a lot of data to a process when it starts up?

Undocumented and hard-to-find information regarding the CreateProcess API call (scroll down to the "Pass arbitrary data to a child process!" section)

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top