How to load a Win32 executable file and run it from memory?

Question

In case i have an executable embedded as a resource in a process and would like to run the process directly from memory without having it on disk.

static void Main()
{
const string pathOfExecutable = @"C:\WINDOWS\system32\notepad.exe"; //size = 67KB 
// read the bytes from the application EXE file
FileStream fs = new FileStream(pathOfExecutable, FileMode.Open);
BinaryReader br = new BinaryReader(fs);
byte[] byteArray = br.ReadBytes(Convert.ToInt32(fs.Length));
fs.Close();
br.Close();


//Process.Start(byteArray) //Cannot use this, any other alternative?

}

You're trying to load notepad.exe as a CLR assembly. Notepad is not a .NET app, thus the BadImageFormatException. The solution you linked to only works for CLR executables. — Reda, Sep 17 '13 at 11:20
http://stackoverflow.com/questions/3553875/load-an-exe-file-and-run-it-from-memory-using-c-sharp — dcaswell, Sep 17 '13 at 13:20
My guess for downvotes would be a lack of a full explanation as to what you are trying to achieve ("described here" doesn't count), seems a little harsh though — Richard Tingle, Sep 17 '13 at 13:22
On an unrelated note; empty catch statements are the devil's play things. I'm a java man so my terminology may be off but consider throwing a runtime exception at least — Richard Tingle, Sep 17 '13 at 13:23

score 2 · Answer 1 · answered Sep 17 '13 at 11:17

2

Assembly.Load will load .net assemblies. Notepad is not such a thing. It's a plain old native Win32 application. What you are attempting to do cannot be done with Assembly.Load.

answered Sep 17 '13 at 11:17

David Heffernan

601,492
42
1,072
1,490

Any ideas on how to load a win32 app from memory? – Martin Sep 17 '13 at 11:18
2

It's not supported. There are many examples of hacking it. You just need to do a websearch to find them. – David Heffernan Sep 17 '13 at 11:22
1

Write the executable contents out to a temporary location then execute it. – ta.speot.is Sep 17 '13 at 11:30

score 2 · Answer 2 · answered Sep 17 '13 at 11:17

2

Your approach works only with managed executables. notepad.exe is a native executable. To run it, use the Process class.

answered Sep 17 '13 at 11:17

kol

27,881
12
83
120

Tried Process.start() – Martin Sep 17 '13 at 12:00
@kol The comment I was replying to was deleted. – ta.speot.is Sep 17 '13 at 12:53
@ta.speot.is OK. Thanks, I thought there is a problem with my answer. – kol Sep 17 '13 at 12:55

score 1 · Answer 3 · answered Sep 17 '13 at 11:32

1

One solution would be to write the memory content to a temporary file (Path.GetTempFileName), then run it with Process.Start()

answered Sep 17 '13 at 11:32

Reda

2,289
17
19

1

-1 *"run the process directly from memory without having it on disk"* – IInspectable Sep 17 '13 at 17:49
@IInspectable You're quoting from an edit made after this answer. At any rate, it's not possible to start an arbitrary Win32 application from memory. This answer is the next best thing. – ta.speot.is Sep 17 '13 at 21:09
1

@ta It is not impossible, just a complex task. The OS does not directly support executing a native binary PE image from memory, however, if you look at a running process have precisely this scenario (ignoring memory mapping of the backing store for argument's sake). A detailed approach is outlined at [Loading a DLL from memory](http://www.joachim-bauch.de/tutorials/loading-a-dll-from-memory/). – IInspectable Sep 17 '13 at 21:31
Not possible to do in any supported fashion. – ta.speot.is Sep 17 '13 at 23:44
1

@ta It is very much supported for kernel modules. – IInspectable Sep 18 '13 at 12:40
The question is not about kernel modules. – ta.speot.is Sep 18 '13 at 12:48

How to load a Win32 executable file and run it from memory?

3 Answers3