Jump to content
Tuts 4 You

Memory allocation/ FileMapping


Recommended Posts



Got a question about the following.

I have a .exe I want to debug using my own tool.

My tool runs the process using CreateProcess, than injects a DLL which sets up a Vectored Exception Handler.

Than I can set breakpoints and such and let the DLL trace through the code.


Now I am wondering if it is possible to make an exact copy of a .exe and map it into memory.

So I can trace through a buffer instead of creating the process and injecting a DLL.


What I tried so far:


1. CreateFile

2. CreateFileMapping

3. MapViewOfFile and MapViewOfFileEx.


The problem I am facing here is that the rva's inside the .exe are not pointing to the proper memory location when you map a file into memory.

Like the Import Table is not pointing to the real imported API's but instead has an RVA.


Anyone got any ideas or code to share on how to map the .exe into memory and fix the RVA's so I am able to trace through an allocated memory buffer

instead of tracing through the real code at runtime?

Link to comment

If you plan to map file it's like combination of virtualalloc and readfile. You get random memory address so you will always have wrong RVA. But you can convert RVA to file offset and this way get what you want.

Link to comment

Now I am wondering if it is possible to make an exact copy of a .exe and map it into memory.

Yes, it's possible. Google "RunPE".

No, it's not a good idea. Not even for debugging purposes.

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...