Running QByteArray executable data direclty in QProcess without running external file

[Vladimir_]

Hello,
This is my second thread, totally different issue.

I want to use QProcess to execute an executable data stored in QByteArray, taken from a hex.

NOTE: when I use QFile to output the data into .exe, the exe will run perfectly.

But I don't want to write it out, I only want to execute it internally in the program.

If QProcess won't do it, please tell me what will do it.

Thanks,
Vladimir.

[ChrisW67]

Nothing in Qt I am aware of. You might be able to do something with low level Windows Api calls, but you will most likely fall foul of data execution prevention. (http://www.wikipedia.com/wiki/data_execution_prevention). Why not just write the code to a QTemporaryFile?

[Vladimir_]

Ok, does QTemporaryFile uses the QByteArray ? I didn't find a way to use my hexadecimal data in it.

If yes, can you please provide me with the solution you offer ?

Thank you.
Vladimir.

Added after 1 53 minutes:

I can't use QTemporaryFile , because I don't want to make an EXTENAL file at all, I want to process the code locally.

[Vladimir_]

in normal c++ i can use this:
((void (*) (void))buf)();

while buf is an array of exadecimals (0xaa, 0xbb ..etc)

how can i do that in Qt !!

[stampede]

Qt is "normal C++". If you need to "extract" raw char * data from QByteArray, use QByteArray::data() or QByteArray::constData() methods.

[anda_skoa]

Ok, does QTemporaryFile uses the QByteArray ?

Well, obviously, it inherits QFile, doesn't it?

Cheers,
_

[Vladimir_]

If you need to "extract" raw char * data from QByteArray, use QByteArray::data() or QByteArray::constData() methods.

if see my previous post (http://www.qtcentre.org/threads/60288-QByteArray-can-t-read-all-the-data-provided) you'll know why I can't use QByteArray::data() .

The code I wrote is as follows:


char buf[] = {
"0x00", "0x11", "0x22" // incredibly LONG array that sometimes cause the crush of QtCreator
};
((void (*) (void))buf)();


but when I do it, the softwae I compile will crush at start.

I tried it in Dev-c++ and everything goes alright. Maybe I need a SMALL array of a small program to try it. -I DIDN'T FIND IT-
and I'm using static compiling, so atleast 7MB for the program i create even if it was "hello world".

Cheers,
Vladimir.

[Vladimir_]

The operation is called: In-memory execution

and I have included ELF binary as an internal function.

Now the issue is more in C++ than in Qt, so if anybody got C++ knowledge please don't hesitate to give me a hint about this.

[d_stranz]

Interesting to note that if you Google "in-memory execution" many of the hits talk about how this is exploited in malware. Maybe you should explain why you want to know how to do this, and why some of the solutions proposed (like writing to a temporary file, then running that) won't work for you. It almost sounds like you want your program to be able to do something without anyone knowing that it is happening, and that is sort of suspicious, don't you think?

[ChrisW67]

in normal c++ i can use this:
((void (*) (void))buf)();

while buf is an array of exadecimals (0xaa, 0xbb ..etc)

how can i do that in Qt !!

If the buf contains the binary of a Windows executable I expect that this would fail in any standard C++, although Windows does occasionally surprise. Buf would have to contain the binary of a lone C++ function accepting no parameters and returning no value. You might as well build that into your program rather than go this roundabout fashion.

How about you tell us what you are trying to achieve with this rather than how you have decided to try to achieve it.

[Vladimir_]

Okay guys,
I coded a malware (educational purpose) and I wanted to make a magic trick.
I will bind some executables automatically with a pogram that vary from one to another in each executable injected.

that file which vary, has something static.. is the data to be downloaded as a base64, afte decoding it become hex, then a function that will return an array of something like 0x11 ..etc , then execute it in memory.
Just the last step is missing.

That's all I will do. This is my first time using Qt, so I hope you help for education's sake.

[Vladimir_]

I found out why: DEP (Data Execution Prevention)

confirmed. aaaand bypassed.

[d_stranz]

aaaand bypassed.

Good for you. And if your malware finds its way onto my computer, I'll do my best to help them put you in jail.